Deployment Architecture

Best practices for Deployment Server sizing and maintenance for 10K clients?

jtsplunk
Splunk Employee
Splunk Employee

What are the hardware requirements for a Deployment Server with up to 10,000 clients? At what point should multiple Deployment Servers be used? Number of clients? Size of apps? Where should one look to diagnose issues? Certain log messages?

At what point does one determine a better option is Puppet or Chef?

There is some guidance of 50+ clients with this article, but this is a much larger deployment:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Updating/Calculatedeploymentserverperformance

woodcock
Esteemed Legend

Watch this video and pay special attention to "Hierarchical Deployments":

https://www.youtube.com/watch?v=3i3Sz3aPrts

0 Karma

bmacias84
Champion

This is a subjective question with a subjective answer. Personally I think you should use both the deployment server and chef.

I would use chef/ puppet to manage the installation and anything in system/local. Items that i thing should not be controlled through apps/ TAs.

For the deployment server I've managed 3k clients using a single deployment server, but with 15 min checkin intervals not the default 5min. The longer your checkin intervals the more server you should be able to support. Thought this make it difficult if you need to deploy rapid changes. Alternatively you can setup a tiered deployment server environment with a single master deployment server. This does add complexity.

The article you reference states 12 core 12GB can support up too 1000 clients with 5min checkin intervals could deploy updates in 9.5minutes with a 50MB payload. If you increase your checkin intervals 10k clients shouldn't be a problem.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...