topic Re: Question about filters for deployment server (4.1.4) in Deployment Architecture

Question about filters for deployment server (4.1.4)

Joffer — Fri, 13 Aug 2010 23:34:57 GMT

Lets say I have this simple serverClasses:

[global]
whitelist.0 = *

[serverClass:Windows]
machineTypes = windows-intel

[serverClass:Windows:app:some-app]
whitelist.0 = *
stateOnClient = enabled
restartSplunkd = true

Will the whitelist in "some-app" enable the app for linux servers (and all other servers)? Even though I set machineTypes to windows-intel in the serverClass? Or will only windows servers be "handed down" to the app stanza and the filtered through the white/blacklists?

Can I use whitelist, blacklist and machineTypes in one and the same stanza?

Re: Question about filters for deployment server (4.1.4)

gkanapathy — Mon, 16 Aug 2010 08:25:51 GMT

It doesn't work the way you'd think. machineTypes are only applied if a machine is blacklisted (or not whitelisted).

In your above file, some-app will be sent to all machines, as whitelist.0 = * is inherited from [global]. (machineTypes = windows-intel is inherited in the app:some-app stanza from the server:Windows stanza, but is never checked because of the whitelist.

I usually set blacklist.0 = * in the global stanza just so that machineTypes settings work a little better.

Re: Question about filters for deployment server (4.1.4)

ftk — Mon, 16 Aug 2010 19:27:05 GMT

I was not aware of that. Especially when looking at the docs, where the example for machineTypes uses a whitelist. (http://www.splunk.com/base/Documentation/latest/Admin/Definedeploymentclasses) Should the docs team be alerted that this article needs revision?

Re: Question about filters for deployment server (4.1.4)

Joffer — Mon, 16 Aug 2010 20:00:06 GMT

So, in my config above, if I don't put the global whitelist, the whitelist in some-app would "overrun" the inherited machineTypes from the Windows class, and linux servers would be a match for the app?

Re: Question about filters for deployment server (4.1.4)

Joffer — Mon, 16 Aug 2010 20:14:49 GMT

One important thing I noticed is that my Windows x64 servers sends an utsname=windows-x64 to splunk, and not windows-intel as I thought.

Re: Question about filters for deployment server (4.1.4)

gkanapathy — Tue, 17 Aug 2010 01:37:11 GMT

if you run a ./splunk list deploy-clients from the deployment server, it will list out the machines that have connected and their self-identified utsname/machineTypes

Re: Question about filters for deployment server (4.1.4)

Joffer — Tue, 17 Aug 2010 15:49:48 GMT

Yepp, thats where I found it 🙂

Re: Question about filters for deployment server (4.1.4)

Joffer — Tue, 17 Aug 2010 15:52:48 GMT

I ended up skipping all lists in [global] and just do my config in the serverClass stanzas (and :app:xxx). It finally worked.

Still, I would like to have my previous question confirmed or not:

"So, in my config above, if I don't put the global whitelist, the whitelist in some-app would "overrun" the inherited machineTypes from the Windows class, and linux servers would be a match for the app?"

Put another way, will a whitelist.0 = * in a :app:xxx stanza overrun a parent serverclass machineTypes filter, or will '*' only apply to the supplied machineTypes servers?