Splunk Dev

How to create a serverclass.conf file to control the configuration of the Exchange App deployment

seanyoung
Engager

I'm looking for a sample a serverclass.conf file, to help me create one for my Exchange 2007 and 2010 Environment. I'm stuck on the Deploying configurations for all server section in the Splunk App for Microsoft Exchange Deploy...

yannK
Splunk Employee
Splunk Employee

Here is an example of the serverclass.conf with the 3 groups CAS-HUB-STORE

# CAS classes
[serverClass:Exchange07CAS]
whitelist.0=cas01.domain.com
whitelist.1=cas02.domain.com
whitelist.2=cas03.domain.com
[serverClass:Exchange07CAS:apps:fwd_exchange2007_cas]

[serverClass:ExchangeWin2K3CAS]
whitelist.0=cas01.domain.com
[serverClass:ExchangeWin2K3CAS:apps:fwd_win2003_iis]

[serverClass:ExchangeWin2K8CAS]
whitelist.0=cas02.domain.com
whitelist.1=cas03.domain.com
[serverClass:ExchangeWin2K8CAS:apps:fwd_win2008r2_iis]


# HUB classes
[serverClass:Exchange07HUB]
whitelist.0=hub01.domain.com
whitelist.1=hub02.domain.com
[serverClass:Exchange07HUB:apps:fwd_exchange2007_hub]
[serverClass:Exchange07HUB:apps:fwd_exchange2007_forefront]

# Store classes
[serverClass:Exchange07STORE]
whitelist.0=store01.domain.com
whitelist.1=store02a.domain.com
whitelist.2=store02b.domain.com
[serverClass:Exchange07STORE:apps:fwd_exchange2007_store]

# Reputation classes
[serverClass:ExchangeREP]
whitelist.0=extweb.domain.com
[serverClass:ExchangeREP:apps:fwd_reputation]

mataharry
Communicator

To resume, in your serverclass.conf :

  1. Create 3 server classes: "Exchange Client Access", "Exchange Hub Transport" and "Exchange Mailbox Store"
  2. Put the appropriate hosts in each class. It is ok if the host appears in multiple classes.
  3. Deploy the apps as follow
    fwd_exchange20XX_cas and fwd_win2003_iis to the CAS/client Access servers, 
    fwd_exchange20XX_hub and fwd_exchange20XX_forefront to the Hub transports
    fwd_exchange20XX_store to the mailbox Store.
    the additional apps to deploy is fwd_reputation that can be on any server with internet access. 
    

Brian_Osburn
Builder

I've only done it for Exchange 2007. It may also not be the best way to do things, but this is the way I did it (note that our CAS and HUB servers are one and the same):

[global]

[serverClass:Exchange-2007-ForeFront:app:fwd_exchange2007_forefront]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-CasHub:app:fwd_exchange2007_cas]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-CasHub:app:fwd_exchange2007_hub]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-Store:app:fwd_exchange2007_store]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-Reputation:app:fwd_reputation]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-Windows-2008R2:app:fwd_win2008r2_iis]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-CasHub]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*

[serverClass:Exchange-2007-Store]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchmb0*

[serverClass:Exchange-Reputation]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub01

[serverClass:Exchange-Windows-2008R2]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*
whitelist.1 = pwexchmb0*

[serverClass:Exchange-2007-ForeFront]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*

seanyoung
Engager

Thanks for the answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...