Universal forwarder to Deployment Server Fail

daniel333 — Mon, 28 Sep 2020 13:02:18 GMT

Heads up, I am only a part time user of splunk at best.

I have a box which I installed the Universalforwarder and would like it to check into the deployment server.

1) I believe the deploymentclient.config to be correct as it's identical to others in use (MD5 verified)
2) I verified ports are open via telnet hostname.domain.local 8089

Yet when I goto the deployment server and check the Deployment Monitor Dashboard I don't see it checking in. I waited over an hour and the box does not seem to be under any sort of high load.

I went to the command line and issues ./splunk list deploy-clients and returned all my other hosts. But not the one in question.

I opted to tail the log and restart (sudo tail -100f /opt/splunkforwarder/var/log/splunk/splunkd.log)

I see the below and the logs just sort of end.
[code][i]
01-02-2013 20:11:41.982 +0000 INFO TailingProcessor - TailWatcher initializing...
01-02-2013 20:11:41.983 +0000 INFO TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk.
01-02-2013 20:11:41.983 +0000 INFO TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk/...stash_new.
01-02-2013 20:11:41.983 +0000 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/etc/splunk.version.
01-02-2013 20:11:41.983 +0000 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk.
01-02-2013 20:11:41.983 +0000 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log.
01-02-2013 20:11:41.983 +0000 INFO BatchReader - State transitioning from 2 to 0 (initOrResume).
01-02-2013 20:11:41.984 +0000 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.
01-02-2013 20:11:46.998 +0000 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
[/code][/i]

Any ideas on steps I would take from here?

Re: Universal forwarder to Deployment Server Fail

jonuwz — Thu, 03 Jan 2013 13:44:19 GMT

Are you getting any data at all from that host ?

This definately doesn't look right :

01-02-2013 20:11:41.984 +0000 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

I would suggest comparing $SPLUNK_HOME/etc/system/local/outputs.conf against a working system to see if your universal forwarder knows where to talk to.

Re: Universal forwarder to Deployment Server Fail

kristian_kolb — Thu, 03 Jan 2013 15:04:45 GMT

the second last message just means that there is no valid configuration on the forwarder for where to send the logs (usually on port 9997). That is done in outputs.conf.

None of the messages above concern the traffic between the forwarder and the deployment server (default port 8089)

topic Universal forwarder to Deployment Server Fail in Getting Data In

Universal forwarder to Deployment Server Fail

Re: Universal forwarder to Deployment Server Fail

Re: Universal forwarder to Deployment Server Fail