topic Re: What are the best practices for installing SoS on cluster? in All Apps and Add-ons

What are the best practices for installing SoS on cluster?

jtworzydlo — Thu, 28 Mar 2013 14:24:03 GMT

As written above - I just set up a cluster (Master, 2 Indexers + SearchHead). Are there some good practices for installing SoS on cluster? Is it also pushed from teh master to the nodes or installed on search head as in distributed deployment?

Re: What are the best practices for installing SoS on cluster?

alacercogitatus — Thu, 28 Mar 2013 16:14:35 GMT

You may want to consult this doc:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Clustersinscaledoutdeployments#Cluster_peer_management_compared_to_deployment_server

To Install SoS in a cluster, install the app on the search head, and the TA-sos on the indexers. Or use deploy-server to send the TA to the indexers.

Re: What are the best practices for installing SoS on cluster?

hexx — Fri, 07 Jun 2013 19:44:29 GMT

@alacercogitatus has the gist of it but there are a few more details.

This is a 3-step process:

Install the S.o.S app on the search-head(s).
Install the S.o.S app on the cluster master. This is the only instance where the "Cluster Master View" will work.
Install the S.o.S technology add-on on the peers by means of the cluster configuration bundle. Deployment server is not a supported method to push content to cluster peers.

NB:

Don't forget to enable the scripted inputs ( lsof_sos.sh and ps_sos.sh) before pushing them out.
Due to a Splunk bug (SPL-64308), the file permissions of scripted inputs distributed by the cluster configuration bundle on the peers will be incorrect and will need to be manually corrected. This will be fixed in maintenance release 5.0.4.

Re: What are the best practices for installing SoS on cluster?

jtworzydlo — Fri, 14 Jun 2013 09:33:59 GMT

Thanks a lot for the detailes!

Re: What are the best practices for installing SoS on cluster?

agodoy — Fri, 21 Jun 2013 18:59:17 GMT

Thanks for the great response.
The permissions in SPL-64308 can be change on the slave-apps directory on the peers or does it have to be changed in the bundle and redeploed?
Is SPL-64308 available to the public?

Re: What are the best practices for installing SoS on cluster?

hexx — Fri, 21 Jun 2013 20:21:33 GMT

You're welcome.
You need to manually change the permissions on the peers etc/slave-apps/$APP/bin/* files.
Not at this time. It will definitely be fixed with our next maintenance release (5.0.4) and may be a part of a special patch before that.

Re: What are the best practices for installing SoS on cluster?

andrey2007 — Tue, 14 Apr 2015 15:32:26 GMT

"Install the S.o.S app on the cluster master. This is the only instance where the "Cluster Master View" will work."
Is it the case for situation when I forward all indexes from Cluster Master to Indexers layer?

Re: What are the best practices for installing SoS on cluster?

hexx — Wed, 15 Apr 2015 17:45:25 GMT

Yes, that will work fine.

Re: What are the best practices for installing SoS on cluster?

andrey2007 — Mon, 27 Apr 2015 16:36:57 GMT

Is it really the ONLY instance where the "Cluster Master View" will work" in case of forwarding of indexes?

Re: What are the best practices for installing SoS on cluster?

hexx — Mon, 27 Apr 2015 18:20:50 GMT

Yes, because that view (and the "Bucket Fix-up Activity" view) depend on searches against the local (in other words, the Cluster Master's) REST API to be populated.

Re: What are the best practices for installing SoS on cluster?

andrey2007 — Tue, 28 Apr 2015 07:38:23 GMT

Ok, thank you for clarifying!

Re: What are the best practices for installing SoS on cluster?

theunf — Sun, 07 Jun 2015 07:11:00 GMT

If the Search Heads are not forwarding sos logs to the indexing cluster you should create a static distributed peer for each SH on the master.
It´ll then see Search Heads logs althought they will be listed as Indexers on the topology.

Another way is to forward sos logs from the Search Head just to the Master if this could not be added to the indexing cluster disk usage.

Re: What are the best practices for installing SoS on cluster?

singhbc — Thu, 30 Jul 2015 21:13:30 GMT

Is it any different if the Search Heads are part of a SH Cluster? Still follow the same steps?

Re: What are the best practices for installing SoS on cluster?

sk314 — Thu, 30 Jul 2015 21:43:24 GMT

I have a similar setup (2 search heads in a cluster, 3 clustered indexers).It's the same process. Install the S.o.S app on the search heads using the deployer.

Re: What are the best practices for installing SoS on cluster?

hexx — Fri, 31 Jul 2015 01:33:14 GMT

Or better yet: Since you are running Splunk 6.2, use the Distributed Management Console to monitor your Splunk deployment.

Note that as of right now, S.o.S is not certified on search-head clusters. Read more this here.