I'm looking for a sample a serverclass.conf file, to help me create one for my Exchange 2007 and 2010 Environment. I'm stuck on the Deploying configurations for all server section in the Splunk App for Microsoft Exchange Deploy...
Here is an example of the serverclass.conf with the 3 groups CAS-HUB-STORE
# CAS classes [serverClass:Exchange07CAS] whitelist.0=cas01.domain.com whitelist.1=cas02.domain.com whitelist.2=cas03.domain.com [serverClass:Exchange07CAS:apps:fwd_exchange2007_cas] [serverClass:ExchangeWin2K3CAS] whitelist.0=cas01.domain.com [serverClass:ExchangeWin2K3CAS:apps:fwd_win2003_iis] [serverClass:ExchangeWin2K8CAS] whitelist.0=cas02.domain.com whitelist.1=cas03.domain.com [serverClass:ExchangeWin2K8CAS:apps:fwd_win2008r2_iis] # HUB classes [serverClass:Exchange07HUB] whitelist.0=hub01.domain.com whitelist.1=hub02.domain.com [serverClass:Exchange07HUB:apps:fwd_exchange2007_hub] [serverClass:Exchange07HUB:apps:fwd_exchange2007_forefront] # Store classes [serverClass:Exchange07STORE] whitelist.0=store01.domain.com whitelist.1=store02a.domain.com whitelist.2=store02b.domain.com [serverClass:Exchange07STORE:apps:fwd_exchange2007_store] # Reputation classes [serverClass:ExchangeREP] whitelist.0=extweb.domain.com [serverClass:ExchangeREP:apps:fwd_reputation]
To resume, in your serverclass.conf :
fwd_exchange20XX_cas and fwd_win2003_iis to the CAS/client Access servers, fwd_exchange20XX_hub and fwd_exchange20XX_forefront to the Hub transports fwd_exchange20XX_store to the mailbox Store. the additional apps to deploy is fwd_reputation that can be on any server with internet access.
I've only done it for Exchange 2007. It may also not be the best way to do things, but this is the way I did it (note that our CAS and HUB servers are one and the same):
[global]
[serverClass:Exchange-2007-ForeFront:app:fwd_exchange2007_forefront]
stateOnClient = enabled
restartSplunkd = true
[serverClass:Exchange-2007-CasHub:app:fwd_exchange2007_cas]
stateOnClient = enabled
restartSplunkd = true
[serverClass:Exchange-2007-CasHub:app:fwd_exchange2007_hub]
stateOnClient = enabled
restartSplunkd = true
[serverClass:Exchange-2007-Store:app:fwd_exchange2007_store]
stateOnClient = enabled
restartSplunkd = true
[serverClass:Exchange-Reputation:app:fwd_reputation]
stateOnClient = enabled
restartSplunkd = true
[serverClass:Exchange-Windows-2008R2:app:fwd_win2008r2_iis]
stateOnClient = enabled
restartSplunkd = true
[serverClass:Exchange-2007-CasHub]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*
[serverClass:Exchange-2007-Store]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchmb0*
[serverClass:Exchange-Reputation]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub01
[serverClass:Exchange-Windows-2008R2]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*
whitelist.1 = pwexchmb0*
[serverClass:Exchange-2007-ForeFront]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*
Thanks for the answer.