topic Re: deploymentclient.conf getting overwritten in Deployment Architecture

deploymentclient.conf getting overwritten

osasfrancis — Wed, 30 Jun 2021 17:22:05 GMT

We are in the process of migrating a lot of hosts to report to a new deployment server. The deploymentclient.conf file was changed to reflect the IP address of the new deployment server and the hosts phones home to the new new deployment server and we verify logs coming in. Then after some time, something modifies the deploymentclient.conf file to have the hosts report back to the old deployment server. We cannot seem to figure out what is making this change. We have uninstalled and reinstalled the universal forwarder on a test client this past week and everything was fine. Then the same thing happened yesterday and the host is reporting back to the old deployment server. This is happening on some hosts, not all. The ones that do not have this problem are reporting to the same new deployment server with no problems.

Any suggestions would be helpful

Re: deploymentclient.conf getting overwritten

richgalloway — Wed, 30 Jun 2021 18:38:23 GMT

Do you have a third-party tool like Ansible or BigFix that might be restoring the file to what it thinks it should be?

Do you have multiple deploymentclient.conf files in different apps in your DS? If so, make sure they're all updated with the new DS's address. Better yet, refactor the apps so you have only one deploymentclient.conf file.

Re: deploymentclient.conf getting overwritten

osasfrancis — Wed, 30 Jun 2021 19:19:53 GMT

We do not use a third party app. Also, there is only 1 deploymentclient.conf file that is getting deployed. It is the same file that was de[p

Re: deploymentclient.conf getting overwritten

burwell — Wed, 30 Jun 2021 19:58:58 GMT

Suggestion: use btool to find out exactly which deploymentclient.conf is getting overwritten.

# /opt/splunkforwarder/bin/splunk btool deploymentclient list --debug /opt/splunkforwarder/etc/apps/myapp/default/deploymentclient.conf [deployment-client] /opt/splunkforwarder/etc/system/local/deploymentclient.conf clientName = my_fwdr /opt/splunkforwarder/etc/apps/myapp/default/deploymentclient.conf phoneHomeIntervalInSecs = 500 /opt/splunkforwarder/etc/system/local/deploymentclient.conf [target-broker:deploymentServer] /opt/splunkforwarder/etc/system/local/deploymentclient.conf targetUri = mydeploymentserver.mycompany.com:1234

Re: deploymentclient.conf getting overwritten

osasfrancis — Thu, 08 Jul 2021 21:02:53 GMT

We figured out the issue. Seems there was a script that was replacing the file.

Thanks for all your responses.

Re: deploymentclient.conf getting overwritten

Ram — Mon, 02 Aug 2021 17:15:47 GMT

Hi,
what was the script name? was it your custom script or some splunk default script.

Re: deploymentclient.conf getting overwritten

osasfrancis — Mon, 02 Aug 2021 17:19:20 GMT

It was a custom script.