Installation

After upgrading license slaves to 6.2.0, but keeping the license master at 6.1.4, how to troubleshoot invalid signature and mismatch errors in splunkd.log?

dshakespeare_sp
Splunk Employee
Splunk Employee

We have a Splunk 6.1.4 License Master with several 6.1.x License Slaves. This configuration has been working well.

We have upgraded the License Slaves to version 6.2 while keeping the License Master at 6.1 and we now have communication issue between the slaves and master

The splunkd.log on the license master contains errors like:

ERROR LMMasterRestHandler - path=/masterlm/usage: invalid signature on request from ip=
ERROR LMHttpUtil - signature mismatch between computed and actual for uri /services/masterlm/usage

We have tried changing the server.conf on the 6.2 LM to reflect 6.1 type setting eg

[sslConfig]
sslVersions = * 
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

We also stripped the custom apps out of the way in case there was some issue there.

This did not remedy the situation. Does anyone have any further suggestions?

Shaky

Labels (3)
0 Karma

sloshburch
Splunk Employee
Splunk Employee

Ok, I'm shocked but I fixed it:

For good measure, I upgraded to 6.1.4, the same level my indexers were on. I realized my license manager was on a 6.0* flavor. Sometimes that inconsistency can caused freaky things so I figured at the least I should fix that.

Then I threw down some btool to check what was up with my license server config.

btool server list --debug | grep -v system

showed me the I had erroneously configured the deployment server to send an app to the license master that contained a definition for the license target! ( [license]'s active_group and master_uri attributes).

After clearing up those shenanigans and restarting, I stopped seeing the error.

So...in my case, my issue was caused by bone-head config by yours truly.

On a side note, this may have caused my license usage to appear dramatically higher than it actually was - which makes sense if it was recursively posting to the license usage as a result of the config loop.,

0 Karma

dshakespeare_sp
Splunk Employee
Splunk Employee

Hi Sloshburch
If you have a support agreement with Splunk - could you raise a support ticket and mention SPL-93066 and this Splunk Answer in the case please?

Kindest Regards
Shaky

0 Karma

dshakespeare_sp
Splunk Employee
Splunk Employee

Hi SloshBurch

No solution yet. Can I ask a question. Do your License Slaves have direct access to the License Master or do they do go thru a firewall / proxy etc

Shaky

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Looks like I'm having this as well. You find any resolution?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...