Getting Data In

How to resolve "err=not_connected" error in Deployment Server configurations?

TiagoTLD1
Communicator

Hi

In the Deployment Server (DS):
- I copied an app to the /opt/splunk/etc/deployment-apps/

In the Universal Forwarder (UF), I configured it as a Deployment Client:
- splunk set deploy-poll 10.10.10.117:8089

Telnet from the UF to DS in 8089 works fine.

In the DS, I get the errors

"DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected"

Any ideas?

Thanks in advance

Vinesh93
Explorer

I have the same problem where i can ping and telnet to deployment server but still i am receiving the error message.. Any possible solutions to solve this?

0 Karma

snaikwade1
Observer

@vinesh were you able to solve the issue? If yes, how ?

0 Karma

Vinesh93
Explorer

@snaikwade1 No, even after trying the possible solutions given by others it still seems to the same error.
But for other clients i didn't face this issue.

0 Karma

arunsundaram
New Member

The Possible issue is the firewall is blocking the management port . if the port is open then the issue will be resolved

0 Karma

dmpopof
Engager

I have same situation. But I can ping and telnet 8089 my deployment server from forwarder host and I have same error in var/log/splunk/splunkd.log on forwarder side. How can I do further troubleshooting?

0 Karma

woodcock
Esteemed Legend

Although this log is INFO severity in splunkd log, it is actually an ERROR. This log is saying that the deploymentclient.conf configuration for the Deployment Server is unreachable from your host. First, figure out which deploymentclient.conf file is in control (you can use btool for this); it is probably in $SPLUNK_HOME/etc/system/local/ (this is not where it should be, but it is usually where people start out). If ICMP is allowed, you can start by trying to ping the IP address for the Deployment Server found in that file. In any case, from there it is a networking exercise. Maybe you don't have a route defined. Maybe you have a firewall blocking it (port 8089). Once you point it to the right place and open up the communication pathway, this log will stop. It would help if you provided the contents of the deploymentclient.conf file.

rballan2
Loves-to-Learn Lots

I have the same error in the splunkd.log file.

The ssh -v DS-IPaddress whos Connection established.

Any other suggestion how to further troubleshooting the issue ?

0 Karma

TiagoTLD1
Communicator

Incredible thing just happened, I brought my pc home and connected to my company network using the vpn.... suddenly th Client appeared in the Forwarder Management

So somehow there is network problem whith my office network that I am not aware of...

0 Karma

woodcock
Esteemed Legend

Hey @TiagoTLD1 , come back here and either post a new answer or find the best/closest one and click Accept to close out the question.

0 Karma

Vinesh93
Explorer

@woodcock I have similar issue in my instance and telnet is fine from both server to DC and vice versa. But still i'm getting the same error in splunkd.log and not able to index new data. When i add some new information's in inputs.conf file its not showing in splunk UI even after restarting splunk forwarder.

0 Karma

woodcock
Esteemed Legend

You are not making sense. This error has nothing to do with indexing or inputs.conf.

0 Karma

Vinesh93
Explorer

@woodcock looking back at your previous comment, i'm able to telnet form both ends so if its a connectivity issue then my connections are working fine but still im getting this error. How to solve this ?

woodcock
Esteemed Legend

Right, like I said, a connectivity problem.

0 Karma

mhouse333
Loves-to-Learn Lots

@woodcock I am having the same issue only difference is when my UF attempts again after a few minutes HandShake is achieved and all the applicable apps are pulled down.  This same pattern is happening across a significant number of endpoints.  Any idea why that would be the case? 

0 Karma

jwelch_splunk
Splunk Employee
Splunk Employee

Did you setup a serverclass.conf? Or use the UI to create your serverclasses?

0 Karma

TiagoTLD1
Communicator

Hi.

Thanks for the response! Yes I did that too. Incredible thing just happened, I brought my pc home and connected to the network using the vpn.... suddenly th Client appeared!

Weird:

Thanks anyway!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...