https://community.splunk.com/t5/Deployment-Architecture/debugging-deployment-server/m-p/108392#M4087 <P>Yes, and they are all splunked. You can find them by searching the _internal index. Additionally, forwarders send their key logs to the indexer, so you see both "sides" of the deployment server / deployment client interaction.</P> <P>Here are some searches that I like to use:</P> <PRE><CODE>index=_internal component=deploy* OR component=serverclass sourcetype=splunkd | fields host component log_level message | table _time host component log_level message index=_internal sourcetype=splunkd component=Metrics group=ds_connections* | rename ip as deploymentClient mgmt as mgmtPort | fields deploymentClient mgmtPort utsname dsevent | table _time deploymentClient mgmtPort utsname dsevent </CODE></PRE> Sun, 03 Feb 2013 05:58:34 GMT lguinn2 2013-02-03T05:58:34Z https://community.splunk.com/t5/Deployment-Architecture/debugging-deployment-server/m-p/108391#M4086 <P>Hi,</P> <P>Are there any logfiles that show the deployment server attempting to push changes out (or, on the other side, in?) I made some changes, but they are not getting pushed out. The connection between the server and client is there, but nothing gets pushed when I reload the server.</P> Sun, 03 Feb 2013 01:48:36 GMT https://community.splunk.com/t5/Deployment-Architecture/debugging-deployment-server/m-p/108391#M4086 a212830 2013-02-03T01:48:36Z https://community.splunk.com/t5/Deployment-Architecture/debugging-deployment-server/m-p/108392#M4087 <P>Yes, and they are all splunked. You can find them by searching the _internal index. Additionally, forwarders send their key logs to the indexer, so you see both "sides" of the deployment server / deployment client interaction.</P> <P>Here are some searches that I like to use:</P> <PRE><CODE>index=_internal component=deploy* OR component=serverclass sourcetype=splunkd | fields host component log_level message | table _time host component log_level message index=_internal sourcetype=splunkd component=Metrics group=ds_connections* | rename ip as deploymentClient mgmt as mgmtPort | fields deploymentClient mgmtPort utsname dsevent | table _time deploymentClient mgmtPort utsname dsevent </CODE></PRE> Sun, 03 Feb 2013 05:58:34 GMT https://community.splunk.com/t5/Deployment-Architecture/debugging-deployment-server/m-p/108392#M4087 lguinn2 2013-02-03T05:58:34Z