https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Upgrades-and-our-Deployment-Server/m-p/451547#M78296 <P>I've been working on automating our UF upgrade process and have found what appears to be an issue with a deprecated key, sslKeysfilePassword ...</P> <P>When I upgrade an old 6.1 or 6.2 host beyond Splunk 6.5, I've found that while the UF can still maintain forwarding over SSL to our indexers, they can no longer handshake with our deployment server.</P> <P>Spending most of my week on this, I've come across a workaround where, prior to performing the upgrade ... ( stopping splunk; tar -zxf blah ), if I remove the deprecated key "<STRONG>sslKeysfilePassword</STRONG>" from etc/system/local/server.conf ... the handshake problem is no longer an issue.</P> <P>The odd thing here is that, this is the <STRONG>only</STRONG> thing that had to be changed to rectify the issue, but my understanding of a deprecated object is that it would just be ignored. It doesn't appear to be the case in this instance.</P> <P>So, this isn't really a question perse, but has anyone ever run up against this before?</P> Thu, 27 Jun 2019 21:26:49 GMT pkeller 2019-06-27T21:26:49Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Upgrades-and-our-Deployment-Server/m-p/451547#M78296 <P>I've been working on automating our UF upgrade process and have found what appears to be an issue with a deprecated key, sslKeysfilePassword ...</P> <P>When I upgrade an old 6.1 or 6.2 host beyond Splunk 6.5, I've found that while the UF can still maintain forwarding over SSL to our indexers, they can no longer handshake with our deployment server.</P> <P>Spending most of my week on this, I've come across a workaround where, prior to performing the upgrade ... ( stopping splunk; tar -zxf blah ), if I remove the deprecated key "<STRONG>sslKeysfilePassword</STRONG>" from etc/system/local/server.conf ... the handshake problem is no longer an issue.</P> <P>The odd thing here is that, this is the <STRONG>only</STRONG> thing that had to be changed to rectify the issue, but my understanding of a deprecated object is that it would just be ignored. It doesn't appear to be the case in this instance.</P> <P>So, this isn't really a question perse, but has anyone ever run up against this before?</P> Thu, 27 Jun 2019 21:26:49 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-Upgrades-and-our-Deployment-Server/m-p/451547#M78296 pkeller 2019-06-27T21:26:49Z