topic Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy in Security

Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

damonmiller — Thu, 03 Mar 2011 01:27:01 GMT

Hello. I have a set of 3 or so search-heads that have matching configurations. I am trying to configure an Apache Reverse-Proxy to load-balance between these servers to maximize search capacity and to handle HTTPS encoding, etc.

I have sucessfully setup the proxy to point to a single search head, but when I configure more than one, I find the sessions continuing to round-robin between servers, intead of "sticking" to on search head after a session is established. I have followed a few recommendations as documented on the Apache mod_proxy and mod_proxy_balancer docs, but so far can't make this work.

Does splunk have any standardized session variables, like "JSESSIONID" or the like I could leverage? Any other suggestions? Has anyone gotten this to work?

Thanks! Damon

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

David — Thu, 03 Mar 2011 01:46:45 GMT

Haven't tried it myself, but looking at my splunk instance, it looks like there is a session_id_HTTPPORTNUMBER (e.g., session_id_8000) cookie. Will that do the trick?

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

gkanapathy — Sat, 05 Mar 2011 11:54:09 GMT

That's correct. The port number is the listen port of the Splunk Web process, 8000 by default.

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

damonmiller — Tue, 08 Mar 2011 00:54:32 GMT

Hmmm. I tried adding that session cookie to the apache config, but can't seem to make that work- I am continually redirected back to the Splunk login screen when more than one backend proxies are configured. I'm assuming this is a session issue, because proxying a single backend server works fine, its when I add two or more that the behavior starts... I suppose this is more an Apache issue than Splunk, but I thought someone must have tried this.

Here is my Apache config snippet (more or less straight out of the Apache docs):

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

damonmiller — Mon, 28 Sep 2020 09:25:57 GMT

ProxyPass / balancer://mycluster/ stickysession=session_id_8000 nofailover=On timeout=15

ProxyPassReverse / balancer://mycluster/ stickysession=session_id_8000

BalancerMember http://10.x.x.10:8000
BalancerMember http://10.x.x.11:8000

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

damonmiller — Tue, 08 Mar 2011 02:28:47 GMT

Finally got this working using Apache's internal balancer cookies (ROUTEID) as described in http://httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html#example