topic Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why? in Security

"This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Wed, 04 Oct 2017 10:48:56 GMT

I have a Linux server with Splunk Enterprise and splunk heavy forwarder installed. In the splunk log, I am getting this error. Could you please help me in resolving this error.

I am using trial license in this development Splunk enterprise .

ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip =XX.XX.XX.XX

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Wed, 04 Oct 2017 12:59:43 GMT

Hi Monica,

The Enterprise trial license does not support acting as a remote master.

If all the instances are using the trial, just set each instance to be it's own master.

Settings > Licensing > set to Master.

If you would like to test remote license master functionality, I suggest you go to dev.splunk.com and get a 10 GB dev license which is fully featured.

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Wed, 04 Oct 2017 13:06:26 GMT

I don't find set to Master option in settings->Licensing page

Licensing
This server is acting as a standalone license server Change to slave
Trial license group
Change license group
This server is configured to use licenses from the Trial license group
Add licenseUsage report
Alerts
Licensing alerts notify you of excessive indexing warnings and licensing misconfigurations. Learn more
Current
1 pool warning reported by 1 indexer Correct by midnight to avoid violation Learn more
Permanent
1 pool quota overage warning reported by 1 indexer 4 days ago

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Wed, 04 Oct 2017 13:16:49 GMT

which host is this on? did you check both? This example you gave seems to be set ok. Check for any instances pointing at another instance for licensing. the log should tell you which host the event came from and which IP is trying to connect.

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Tue, 29 Sep 2020 16:01:49 GMT

10-05-2017 17:06:13.358 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=5 AppEvents from DC ip=xx.xx.xx.xx[**UniversalforwarderServer1] name=C4B5644E-48AF-4919-B16E-DE5809D2B132
10-05-2017 17:06:30.998 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=5 AppEvents from DC ip=xx.xx.xx.xx[UniversalforwarderServer2] name=47E99D8A-38E8-4EF8-AD6F-0B994E6E9664
10-05-2017 17:06:43.739 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=8 AppEvents from DC ip=xx.xx.xx.xx[**UniversalforwarderServer3] name=A416CC44-2A2D-4C49-8FBC-8FEBB768261D
10-05-2017 17:06:57.925 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server]
10-05-2017 17:07:02.140 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=12 AppEvents from DC ip=xx.xx.xx.xx[UniversalforwarderServer4] name=3DCF6768-1AB6-4A2C-BFA1-D866BD962668
10-05-2017 17:07:06.984 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=10 AppEvents from DC ip=xx.xx.xx.xx[**UniversalforwarderServer5] name=45BE1CBC-C7AA-44C8-80A8-92B31FE400B2
10-05-2017 17:07:57.925 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server]
10-05-2017 17:08:58.928 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server*]
10-05-2017 17:09:39.268 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=6 AppEvents from DC ip=xx.xx.xx.xx[Splunk enterprise server] name=1460741B-03D5-4013-AD62-2F72D217CFAA
10-05-2017 17:09:59.927 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server*]
10-05-2017 17:10:59.926 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server***]

I am trying to monitor the application logs from 5 servers [I have installed universal forwarder on all 5 servers] and forwarding the logs to 6th server, where splunk enterprise and splunk heavy forwarder is installed. in the splunk enterprise server I am getting the above error which is mentioned in this post.

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Thu, 05 Oct 2017 13:08:22 GMT

10-05-2017 17:06:57.925 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server]

what machine owns the IP in this log??Is it the IP of your enterprise server??? Or is the IP of another server?

The universal forwarders should be fine, as they do not require a license.

I would check the Heavy Forwarder config to make sure you didn't point it at the Enterprise Install for licensing.

If that is not the case, then the other thing to look for might be distributed search functions. I believe those are locked down too. Did you try and set up search peers??

https://www.splunk.com/en_us/products/features-comparison-chart.html

The best way to not have to worry about any of this, is to go to dev.splunk.com and get a free 10GB dev license which is fully featured.

Other than seeing this in your logs, are you running into any issues or unable to use a function that you want to use??

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Thu, 05 Oct 2017 13:37:27 GMT

what machine owns the IP in this log??Is it the IP of your enterprise server??? Or is the IP of another server?

Yes it is the IP of the splunk enterprise server.

If that is not the case, then the other thing to look for might be distributed search functions. I believe those are locked down too. Did you try and set up search peers??
All server logs are getting monitored except splunk enterprise rhel logs

apart from this above two issues I am not facing any issues.
I would check the Heavy Forwarder config to make sure you didn't point it at the Enterprise Install for licensing.
can you please tell me the file name of the heavy forwarder configuration which you need?so that I can share it with you.

The best way to not have to worry about any of this, is to go to dev.splunk.com and get a free 10GB dev license which is fully featured.
I will check on this if these issues are not resolved.

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Thu, 05 Oct 2017 14:11:39 GMT

try running ./splunk btool server list license --debug on your heavy forwarder, or just log into the Heavy forwarder and check under Settings > Licensing to confirm that is is acting as a master and is not pointing to your Enterprise instance.

For example, here is my standalone License master:

[splunker@n00bserver bin]$ ./splunk btool server list license --debug
/home/splunker/splunk/etc/system/local/server.conf   [license]
/home/splunker/splunk/etc/system/local/server.conf   active_group = Enterprise
/home/splunker/splunk/etc/system/default/server.conf connection_timeout = 30
/home/splunker/splunk/etc/system/default/server.conf master_uri = self
/home/splunker/splunk/etc/system/default/server.conf receive_timeout = 30
/home/splunker/splunk/etc/system/default/server.conf report_interval = 1m
/home/splunker/splunk/etc/system/default/server.conf send_timeout = 30
/home/splunker/splunk/etc/system/default/server.conf squash_threshold = 2000
/home/splunker/splunk/etc/system/default/server.conf strict_pool_quota = true

The key here being master URI. I am assuming somewhere along the line in your set up, you have either configured the master URI on the HF, or you have configured a setting not supported by the standalone. Being that the error is the rest call (LMMasterRestHandler) someone is calling the Enterprise Instance as a slave, which is not supported on the trial.

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Tue, 29 Sep 2020 16:11:47 GMT

Hi Please find the command output below.
[root@************** bin]# ./splunk btool server list license --debug
/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf [license]
/appl/splunkheavyforwarder/etc/system/default/server.conf connection_timeout = 30
/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri = https://xx.xx.xx.xx[Splunk enterprise server ip]:8089
/appl/splunkheavyforwarder/etc/system/default/server.conf receive_timeout = 30
/appl/splunkheavyforwarder/etc/system/default/server.conf report_interval = 1m
/appl/splunkheavyforwarder/etc/system/default/server.conf send_timeout = 30
/appl/splunkheavyforwarder/etc/system/default/server.conf squash_threshold = 2000
/appl/splunkheavyforwarder/etc/system/default/server.conf strict_pool_quota = true

Licensing
This server is associated with a remote master license serverSwitch to local master
Local server information

Indexer name XXXXXXXXXXXXX
Master server URI https://xx.xx.xx.xx[Splunk Enterprise server IP]:8089
Last successful contact time 2 days ago (10/4/17 3:44 PM)
Messages Show all messages

Show all configuration details

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Fri, 06 Oct 2017 14:09:10 GMT

thats your issue right there:

/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri = https://xx.xx.xx.xx[Splunk enterprise server ip]:8089

Licensing
This server is associated with a remote master license serverSwitch to local master
Local server information

You cannot point to a remote master on trial license. Switch to local master on the HF and you are good to go!

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Tue, 29 Sep 2020 16:12:35 GMT

Hi Modestino,

local master means? Do I need to change the IP or do I need to change the port in this line?/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri =

if I want to change the IP means, What I have to change?
because in my case I am having Server A, where both Splunk enterprise and Splunk heavy forwarder is installed in the same server[A]. Server B,C,D,E,F is having universal forwarder installed in order to forward the application logs to Splunk heavy forwarder, whereas it will forward the log to splunk enterprise instance.

Currently I have mentioned ServerA ip here.
/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri = https://xx.xx.xx.xx[Splunk enterprise server ip]:8089

In case if I want to change the IP in this line. Which server IP I have to mention here. Kindly help me on this?in /appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri =

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Mon, 09 Oct 2017 14:07:37 GMT

Had to post a new answer as we used all the comments on my original answer:

Step 1: Log into the GUI of your Heavy Forwarder.
Step 2: Settings > Licensing
Step 3: Press radio button to switch to local master.

Done.

You don't have to change IPs or anything like that. The issue is that you pointed the Heavy Forwarder at the Splunk Enterprise instance as a license master. You cannot do that on the free license.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Configurealicensemaster

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Tue, 10 Oct 2017 05:05:09 GMT

thanks Modestino.After following the instructions given by you, this is the screen output . Please check and let me know it is correct. Now I am not getting any error regarding license in splunkd.log

This server is acting as a standalone license server Change to slave
Trial license group
Change license group
This server is configured to use licenses from the Trial license group
Add licenseUsage report
Alerts
Licensing alerts notify you of excessive indexing warnings and licensing misconfigurations. Learn more
Current
No licensing alerts
Permanent
No licensing violations
Local server information

Indexer name XXXXXXX[Splunk enterprise server Host name]
License expiration Dec 3, 2017 3:29:39 PM
Licensed daily volume 500 MB
Volume used today 0 MB (0% of quota)
Warning count 0
Debug information All license details
All indexer details

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Tue, 10 Oct 2017 12:13:43 GMT

yep! all good until the trial expires or you get a full license. please feel free to visit dev.splunk.com to get a dev license that you can renew every 6 months!

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Tue, 10 Oct 2017 12:36:49 GMT

Thanks Modestino for helping me to get the issue resolved. where can I find the license expiration info?

In splunk GUI or splunk heavy forwarder GUI?

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Tue, 10 Oct 2017 12:57:16 GMT

my pleasure.

Please be sure to accept the first answer I provided as it seems to have answered your question.

You can find the license info in BOTH the Splunk Enterprise GUI and the Heavy Forwarder GUI Under Settings > Licensing.

I suggest you take some time to review the documentation

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

Monica7 — Tue, 10 Oct 2017 13:01:47 GMT

Thanks Modestino. I have accepted your answer. I will check for the dev license site for getting the dev license.

Thank you again

Re: "This license does not support being a remote master" error on Splunk Enterprise trial - why?

mattymo — Tue, 10 Oct 2017 13:19:06 GMT

enjoy! Let us know how it goes!

you can join a large community of splunkers for tips and tricks at splunk-usergroups.slack.com too to accelerate your learning curve!