topic universal forwarder bug after update to V6 in Getting Data In

universal forwarder bug after update to V6

Ed_Alias — Thu, 27 Mar 2014 10:15:33 GMT

Hello,

since i updated my UF from version 5 to 6 they seem to loop on loading the serverclasses :

it seems like a loop keeps deploying new serverclass

03-27-2014 11:10:54.297 +0100 INFO DeployedServerclass - name=SC_windows_IIS_test Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_IIS_test' 03-27-2014 11:10:54.297 +0100 INFO DeployedServerclass - name=SC_windows_iis Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_iis' 03-27-2014 11:10:54.297 +0100 INFO DeployedServerclass - name=SC_windows_std_602 Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_std_602' 03-27-2014 11:10:54.297 +0100 INFO DC:UpdateServerclassHandler - Changed state from=HandlingPhonehome to=Phonehome 03-27-2014 11:10:54.344 +0100 INFO DC:UpdateServerclassHandler - Changed state from=Phonehome to=HandlingPhonehome 03-27-2014 11:10:54.344 +0100 INFO DeployedServerclass - name=SC_windows_IIS_test Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_IIS_test' 03-27-2014 11:10:54.344 +0100 INFO DeployedServerclass - name=SC_windows_iis Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_iis' 03-27-2014 11:10:54.344 +0100 INFO DeployedServerclass - name=SC_windows_std_602 Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_std_602' 03-27-2014 11:10:54.344 +0100 INFO DC:UpdateServerclassHandler - Changed state from=HandlingPhonehome to=Phonehome

Re: universal forwarder bug after update to V6

koshyk — Thu, 27 Mar 2014 11:51:24 GMT

can you also update here .. (a) forwarder configs and (b) serverclass config

Re: universal forwarder bug after update to V6

Ed_Alias — Mon, 28 Sep 2020 16:14:44 GMT

SC_windows_IIS_test is not used anymore (it is empty)

here is the input for the conf_windows_IIS :

[monitor://L:\com\folder\...\*.log]
sourcetype=iis

index = test_index

[monitor://L:\com\folder\...\...\*.log]
sourcetype=iis

index = test_index


[monitor://L:\com\folder\...\...\...\*.log]
sourcetype=iis

index = test_index
recursive = true

Re: universal forwarder bug after update to V6

Ed_Alias — Mon, 28 Sep 2020 16:14:49 GMT

and SC_windows_std_602 input.conf is :

[default]
evt_dc_name = \\server.domain

[WinEventLog:Application]
disabled = 0

[WinEventLog:Security]
disabled = 0

[WinEventLog:System]
disabled = 0'

Re: universal forwarder bug after update to V6

Ed_Alias — Fri, 28 Mar 2014 08:01:10 GMT

what is precisely the (a) forwarder configs ?

Re: universal forwarder bug after update to V6

sbennacer_splun — Wed, 09 Apr 2014 08:13:02 GMT

Hi,
The behavior you see is a Bug. i.e
SPL-78499:DC (deployment client) logging too verbose at default log levels
This Bug is expected to be addressed in coming releases 6.1 .
Kind Regards

Re: universal forwarder bug after update to V6

Ed_Alias — Wed, 09 Apr 2014 08:15:13 GMT

yep thank you sbennacer !

Re: universal forwarder bug after update to V6

eugenezxq — Fri, 21 Sep 2018 03:39:13 GMT

Hi did you guys manage to resolve this issue? Am getting this right now.