topic Brand new Deployment client will not connect. 401 errors in splunkd_access logs on DS in Getting Data In

Brand new Deployment client will not connect. 401 errors in splunkd_access logs on DS

jeremyhagand61 — Wed, 08 Feb 2023 09:26:39 GMT

I'm having trouble getting a new deployment client to connect to the DS. I can see connectivity is established, but the client keeps logging an error:

DC:DeploymentClient ... channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

Looking at the splunkd_access log on the DS I can see the handshake message being recieved with a 401 by the DS

10.X.X.2 - - ... "POST /services/broker/connect/GUID/CLIENTNAME/guff/linux-x86_64/8089/9.0.2/GUID/universale_forwarder/CLIENTNAME HTTP/1.1" 401

I have plenty of Windows machines in the environment connecting successfully to this DS (also running on Windows). But this server and a few other Linux machines are not connecting.

Any advice?

Re: Brand new Deployment client will not connect. 401 errors in splunkd_access logs on DS

scelikok — Wed, 08 Feb 2023 13:25:17 GMT

Hİ @jeremyhagand61,

It seems pass4SymmKey is set on your deployment server. Please try adding pass4SymmKey like below server.conf setting on your deployment clients.

server.conf [deployment] pass4SymmKey = yourpasssymkey

Re: Brand new Deployment client will not connect. 401 errors in splunkd_access logs on DS

jeremyhagand61 — Thu, 09 Feb 2023 09:39:06 GMT

That was it. Someone had been fiddling as it wasn't meant to be enabled. I learned something new about DS auth. I have disabled it on the DS side.

Thanks for the quick response.