Citrix XenApp

[karlosbh]

I'm quite new to installing new apps, and understanding what config file does what.
I am trying to get splunk installed and monitoring set-up on a test basis for our citrix farm.
In a bit of a mess, sorry if the below is not great to read.

At the moment, i have 1 forwarder and 1 deployment/search/indexer server.

Strangley we are getting some info through, but I am seeing the following in the splunkd logs....

but not sure why or where this is configured.........

Basically, On the PST04 (forwader)
It is trying to look in the XA5 Broker app, we only had the XA5 Server app on there. Which i thought, and still tempted to think is correct.
But i put the Broker app on anyway just to see, but the actual file it is looking for is in the Server app, not the broker app. (does that make sense?)

So, not sure where this is configured. Or if i should just copy that 1 file into the broker app. (I feel like I shouldn’t)
What i thought, the broker app should be on the deployment/searchhead, (pj-test) and the server app went on the forwarders. (PST Servers)

Also seeing this....

07-05-2012 16:22:20.217 +0100 INFO
ExecProcessor - New scheduled exec
process:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Broker\bin\powershell\GetXAApplicationReport5.ps1'"
-index xenapp 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor - interval: 3600000 ms 07-05-2012 16:22:20.217
+0100 INFO ExecProcessor - New scheduled exec process:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Broker\bin\powershell\GetXAFarm5.ps1'"
-index xenapp 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor - interval: 300000 ms 07-05-2012 16:22:20.217
+0100 INFO ExecProcessor - New scheduled exec process:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Broker\bin\powershell\GetXAZone5.ps1'"
-index xenapp 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor - interval: 3600000 ms 07-05-2012 16:22:20.217
+0100 INFO ExecProcessor - New scheduled exec process:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA65-Server\bin\powershell\GetInstalledSoftware.ps1'"
-index xenapp_winevents 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor
- interval: 21600000 ms 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor
- New scheduled exec process: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA65-Server\bin\powershell\GetProcess.ps1'"
-index xenapp_winevents 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor
- interval: 180000 ms 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor
- New scheduled exec process: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Broker\bin\powershell\GetXAServer5.ps1'"
-index xenapp 07-05-2012 16:22:20.217 +0100 INFO ExecProcessor - interval: 300000 ms 07-05-2012 16:22:20.233
+0100 INFO ExecProcessor - New scheduled exec process:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Broker\bin\powershell\GetXAServerHotfix5.ps1'"
-index xenapp 07-05-2012 16:22:20.233 +0100 INFO ExecProcessor - interval: 300000 ms 07-05-2012 16:22:20.233
+0100 INFO ExecProcessor - New scheduled exec process:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Broker\bin\powershell\GetXAServerLoad5.ps1'"
-index xenapp 07-05-2012 16:22:20.233 +0100 INFO ExecProcessor - interval: 60000 ms 07-05-2012 16:22:20.233 +0100
INFO ExecProcessor - New scheduled
exec process:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
-command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Broker\bin\powershell\GetXASession5.ps1'"
-index xenapp 07-05-2012 16:22:20.233 +0100 INFO ExecProcessor - interval: 180000 ms 07-05-2012 16:22:20.233
+0100 ERROR ExecProcessor - Unable to open scripted input pointer file
"C:\Program
Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Server\bin\GetXASessionProcess5.path":
The system cannot find the file
specified. 07-05-2012 16:22:20.233
+0100 ERROR ExecProcessor - Skipping stanza "script://C:\Program
Files\SplunkUniversalForwarder\etc\apps\TA-XA5-Server\bin\GetXASessionProcess5.path":
invalid or missing scripted input
pointer file

The files that do exist are - GetXASessionProcess.path & GetXASession5.path

[karlosbh]

At the moment in the directory of the forwarder folder i have-

C:\Program Files\SplunkUniversalForwarder\etc\apps

learned
MSICreated
search
SplunkUniversalForwarder
TA-XA5-Broker (which i'm guessing should not be there)
TA-XA5-Server