topic Re: Serverclass using machineTypes that excludes one server in Deployment Architecture

Serverclass using machineTypes that excludes one server

imacdonald2 — Mon, 28 Sep 2020 10:16:39 GMT

I would like to have a serverclass for all linux machines that excludes one machine.

I have tried the following but it doesn't appear to work, the app fwd_to_splunk still gets deployed to the server.

Any suggestions.

[global]

blacklist.0=*

[serverClass:alllinux]

machineTypes=linux-*

blacklist.0=host1

[serverClass:alllinux:app:fwd_to_splunk]

stateOnClient=enabled

restartSplunkd=true

Re: Serverclass using machineTypes that excludes one server

Kate_Lawrence-G — Wed, 04 Jan 2012 20:23:28 GMT

I'd try something like this:

[global]
[serverClass:AppsByMachineType]
whitelist.0 = *

[serverClass:AppsByMachineType:app:linux-base]
# Deploy this app only to unix boxes - 32/64 bit.
machineTypes = linux-i686, linux-x86_64
restartSplunkd = true
stateOnClient = enabled
blacklist.0 = host1

Re: Serverclass using machineTypes that excludes one server

gkanapathy — Wed, 04 Jan 2012 20:37:36 GMT

Unfortunately, you can't do this. The logic of machineTypes is such that every machine that is blacklisted (or not whitelisted) is checked for the machineType, and then is sent that serverclass/app. (The logic is "matching names OR matching machineTypes", instead of your desired "matching names AND matching machineTypes") This functionality is not useful behavior, and is basically a design flaw.

I expect there to be a change in the 4.3 release of Splunk due very imminently to provide the functionality you're looking for. (And which is useful to most people.)

Re: Serverclass using machineTypes that excludes one server

imacdonald2 — Wed, 04 Jan 2012 21:12:24 GMT

I tried this and it didn't work it still goes out to host1. Do you have this working?

Re: Serverclass using machineTypes that excludes one server

gkanapathy — Wed, 04 Jan 2012 21:40:29 GMT

As I said in my other answer.

Re: Serverclass using machineTypes that excludes one server

imacdonald2 — Wed, 04 Jan 2012 22:36:03 GMT

so it sounds like I can't do this using machineTypes, any thoughts on an other way I can do this? I guess I could do a whitelist.0=0 then blacklist.0=host1, and apply it to all machines. Since the forwarder config is the same for windows and linux

Re: Serverclass using machineTypes that excludes one server

gkanapathy — Thu, 05 Jan 2012 00:38:58 GMT

yes, if it's going to all machines (even if they're not linux), then you can just drop the machineTypes clause, and use white/black lists only.

Re: Serverclass using machineTypes that excludes one server

gavin1_davenpor — Wed, 01 Aug 2012 09:34:42 GMT

Quote: "I expect there to be a change in the 4.3 release of Splunk due very imminently to provide the functionality you're looking for. (And which is useful to most people.)"

I'd like to be able to include all my hosts by machineType but then EXCLUDE a static list of hosts by name - i.e. to be able to use 2 serverclass definitions for the same app.
Define serverclass A based on machineType
Define serverclass B based on hostname/IP
Whitelist by machineType serverclass A
then Blacklist by hostname serverclass B

Did this get incorporated in 4.3.* ?

Re: Serverclass using machineTypes that excludes one server

gkanapathy — Wed, 01 Aug 2012 14:44:22 GMT

see machineTypesFilter setting.

Re: Serverclass using machineTypes that excludes one server

gavin1_davenpor — Wed, 01 Aug 2012 15:11:52 GMT

That didn't answer my question.
I would like to be able to - for a given serverclass -
whitelist based on machineTypesFilter and ALSO blacklist based on hostname.

Your comment from 04/01 suggested you expected this change to be incorporated in the 4.3 version. Did it get incorporated ?

My solution has been to have apps I consider 'stable' to be covered by machineTypesFilter, and apps I consider in development to be covered by whitelists.

Re: Serverclass using machineTypes that excludes one server

gkanapathy — Wed, 01 Aug 2012 15:13:28 GMT

see machineTypeFilter setting and compare with machineTypes setting

Re: Serverclass using machineTypes that excludes one server

gkanapathy — Wed, 01 Aug 2012 15:15:54 GMT

You are also misunderstanding how serverclasses and filters should work. the functionality in 4.3 has nothing to do with working across different serverclasses, only on rules within a serverclass (or app).

Re: Serverclass using machineTypes that excludes one server

gavin1_davenpor — Mon, 28 Sep 2020 12:10:53 GMT

So I can do:
[serverClass:mynewapp]
machineTypesFilter=linux-x86_64
blacklist.0=dont_push_new_app_to_me1.fqdn
blacklist.1=dont_push_new_app_to_me2.fqdn

This would push "mynewapp" to all x86_64 linux hosts EXCEPT the 2 blacklisted ?