Deployment Architecture

Is "phoneHomeIntervalInSecs" being ignored?

mfeeny1
Path Finder

Hi. I'm using a Deployment Server to push configurations to a Splunk Universal Forwarder that is running Windows. For the most part, it is working just fine, thanx. 😉

But... In my deploymentclient.conf, I have a line that says...

phoneHomeIntervalInSecs = 120

And, when I issue the below command on the Deployment Client, it echoes that above setting exactly.

splunk cmd btool deploymentclient list

However, a packet capture shows that the Deployment Client is opening up a TCP connection with the Deployment Server, on the management port, every 60 seconds.

Any ideas why???

Thx,
Michael

mfeeny1
Path Finder

gkanapathy and Lowell,

Sorry for the delay - got tied up in other stuff... But, the good news is...

The workaround referenced by Lowell (above) DID THE TRICK. i placed the "phoneHomeIntervalInsecs" attribute/value in BOTH stanza's ([deployment-client]
AND [target-broker:deploymentServer]), and my value is now being honored.

THX!

Michael

0 Karma

Lowell
Super Champion

You may have found a known bug. Check out the following post and see if this workaround works for you:

http://splunk-base.splunk.com/answers/27748/deployment-clients-phonehomeintervalinsecs-setting-is-no...

gkanapathy
Splunk Employee
Splunk Employee

is that setting under a [deployment-client] stanza?

gkanapathy
Splunk Employee
Splunk Employee

uh, well, you can enable DeploymentServer and DeploymentClient debugging in the splunkd.log to help figure it out, instead of just sniffer. At the CLI, run ./splunk _internal call /server/logger/DeploymentServer -post:level DEBUG on the server, and appropriately on the forwarder.

0 Karma

mfeeny1
Path Finder

Well, it is NOW!! (But, it wasn't before 😉

And the Distributed Deployment Manual clearly shows it as being an attribute belonging to the [deployment-client] stanza, so I have no one to blame but myself for that one.

BUT... Putting the attribute in the correct stanza didn't seem to fix it! Here is what I just did...

I modified "deploymentclient.conf" in the appropriate app directory on the Deployment Server, and "reloaded" the Deployment Server for the appropriate Class, which resulted in that new, correctly configured deploymentclient.conf to get pushed to the Deploy Client. As evidence that the new setting did get deployed, I crack open deploymentclient.conf in the appropriate apps directory of the Deploy Client, and I see the edit is in there, and, now when I execute the btool list command, the phoneHome setting is shown to be in the [deployment-client] stanza - which was not the case before.

Yet... a packet capture still shows what I believe is the phonehome call being made every 60 seconds. I say that because it uses the management port, and it is going to the Deployment Server's IP Address.

Thx for pointing out my original mistake, but could you help me find what I'm doing wrong NOW???

🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...