topic Re: DeploymentClient - Unable to send handshake message in Deployment Architecture

DeploymentClient - Unable to send handshake message

mfeeny1 — Wed, 10 Aug 2011 18:42:56 GMT

Hello.

I just installed the Universal Forwarder on a Windows 2K server. As part of that installation process, I also set up DeploymentClient.conf to point to the Deployment Server, as follows:

[target-broker:deploymentServer]
targetUri = <FQDN of Deployment Server>:<tcp port to use>

But, when I start up Splunk, the log includes the following message:

DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected

I have captured packets during Splunk Start execution on the Universal Forwarder, and I do see that the Universal Forwarder machine successfully creates a TCP connection to the Deployment Server, on the designated port, and they converse briefly. The connection lasts a few tenths of a second, and then the Universal Forwarder machine closes the connection.

Can anyone suggest why I'm getting the "Unable to send handshake" Warning, and how to resolve it?

thx,
mfeeny1

Re: DeploymentClient - Unable to send handshake message

mfeeny1 — Wed, 10 Aug 2011 20:36:44 GMT

I don't know why, but now that my question, above, is on this web site, there is a scroll bar where a line of text used to be.

So I will re-enter the text...

Hello.

I just installed the Universal Forwarder on a Windows 2K server. As part of that installation process, I also set up DeploymentClient.conf to point to the Deployment Server, as follows:

[target-broker:deploymentServer]
targetUri = <FQDN of Deployment Server>:<tcp port to use>

But, when I start up Splunk, the log includes the following message:

DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected

Can anyone suggest why I'm getting the "Unable to send handshake" Warning, and how to resolve it?

Thx,
mfeeny1

Re: DeploymentClient - Unable to send handshake message

billynewport — Tue, 07 Feb 2012 21:07:45 GMT

I have the same issue on 4.3. Everything was working for a few days but now, only the main server is working. All the other forwarders look to be locked out with this issue.

Re: DeploymentClient - Unable to send handshake message

lifetech — Mon, 09 Jul 2012 21:53:19 GMT

I'm seeing the same thing - unfortunately this is my first time trying out the deployment server. So far I'm pretty unimpressed.

Re: DeploymentClient - Unable to send handshake message

jchampagne — Wed, 08 Aug 2012 15:06:19 GMT

I'm having the same problem, but only on a heavy forwarder that is acting as a gateway between our DMZ and internal network. All of the servers using the deployment client that are internal are fine.

I've opened firewall port 8089 between the gateway and internal indexer, but am still receiving: Unable to send handshake message to deployment server

Re: DeploymentClient - Unable to send handshake message

lifetech — Mon, 28 Sep 2020 12:13:25 GMT

I had to create the app to deploy, which I missed in my first try. So in my serverclass.conf I had to put in:

[serverClass:windows_default]
machineTypesFilter = Windows*,windows*

[serverClass:windows_default:app:windows_default] <-- the app to deploy to the clients.
stateOnClient=enabled
restartSplunkd=true

Re: DeploymentClient - Unable to send handshake message

domteich — Tue, 02 Oct 2012 12:08:38 GMT

Was there a solution for this problem?

Re: DeploymentClient - Unable to send handshake message

mship — Mon, 04 Mar 2013 13:46:43 GMT

I had the same issue on 2 different networks running Splunk 5.0.1

the first issue was resolved but adding the following to the inputs.conf file on my indexer:

[splunktcp://9997]
connection_host = none

Also make sure you are not blacklisting anything in your serverclass.conf
All frowarders

[serverClass:all_forwarder]
whitelist.0 = *

The second issue was a network config issue on my ACLs.

Hope one of these helps

Re: DeploymentClient - Unable to send handshake message

dstaulcu — Thu, 19 Sep 2013 01:52:14 GMT

In my case, serverclass was correct but the app was not present in the repository. corrected that issue and restarted splunk on deployment server.

while the app was missing, clients were getting the handshake error noted above every 60 seconds. my phoneHomeInterval is set to 4 hours but the handShakeRetry (undefined) was recurring every 60 seconds. With thousands of deployment clients, the constant retries were overrunning our deployment server.

eventually, I got the message "DeploymentClient has been asked to redo-handshake. Resetting to initial state." after that, the app downloaded and I didn't get the handshake error any more.

lessons learned? don't forget to put app in in repository. don't assume that handShakeRetry tracks with customized phoneHomeIntervalInSecs value.