Got a brand new install of 4.2 on a Windows 2008 R2 server. Set it up as a deployment server. Installed the unv forwarder on another Windows 2003 server, and pointed it to the first server as a deployment server.
It picked up the 2 server classes that it was supposed to, but couldn't implement them because it couldn't unarchive the tar.gz file that the configs are put into! from the unv forwarder server, here's the splunkd.log:
04-13-2011 17:38:22.482 -0400 INFO DeployedApplication - Checksum mismatch 17827980805161142201 <> 635300122953481294 for app: WindowsEvents. It will be reloaded again from: indexer01.mycompany.com:8089/services/streams/deployment?name=default:Windows Forwarders:WindowsEvents
04-13-2011 17:38:22.482 -0400 INFO DeployedApplication - Remote repository has resolved to: indexer01.mycompany.com:8089/services/streams/deployment?name=default:Windows Forwarders:WindowsEvents
04-13-2011 17:38:22.498 -0400 INFO DeployedApplication - Downloaded url: indexer01.mycompany.com:8089/services/streams/deployment?name=default:Windows Forwarders:WindowsEvents to file: C:\Program Files\SplunkUniversalForwarder\var\run\Windows Forwarders\9dd4e0cd6fd8dcd6.tar.gz
04-13-2011 17:38:22.498 -0400 WARN DeployedApplication - Computed checksum after downloading app: WindowsEvents does not match with expected remote checksum: 17827980805161142201 <> 635300122953481294
04-13-2011 17:38:22.498 -0400 WARN DeployedApplication - Installing app: WindowsEvents to location: C:\Program Files\SplunkUniversalForwarder\etc\apps\WindowsEvents
04-13-2011 17:38:22.498 -0400 ERROR ArchiveFile - In archive 'C:\Program Files\SplunkUniversalForwarder\var\run\Windows Forwarders\9dd4e0cd6fd8dcd6.tar.gz': Unrecognized archive format
04-13-2011 17:38:22.498 -0400 WARN DeployedApplication - There was a problem unarchiving C:\Program Files\SplunkUniversalForwarder\var\run\Windows Forwarders\9dd4e0cd6fd8dcd6.tar.gz due to Unrecognized archive format. The operation completed successfully.
04-13-2011 17:38:22.498 -0400 WARN DeployedServerClass - There was a problem installing app: WindowsEvents for server class: Windows Forwarders
Do I have to install an app to be able to untar these files? Or should that ability be built into the splunk binaries for the unv forwarder?
Resolved - the server classes I had specified contained spaces; you can't use spaces in the server class name. So I changed Windows Forwarders to WindowsForwarders and ran splunk reload deploy-server on the deployment server and all was well.
Also went through and deleted the 'Windows Forwarders' folder from C:\Program Files\SplunkUniversalForwarder\var\run on each Universal Forwarder server.
Resolved - the server classes I had specified contained spaces; you can't use spaces in the server class name. So I changed Windows Forwarders to WindowsForwarders and ran splunk reload deploy-server on the deployment server and all was well.
Also went through and deleted the 'Windows Forwarders' folder from C:\Program Files\SplunkUniversalForwarder\var\run on each Universal Forwarder server.
Spaces in the server class will also result in the same problems on non-Windows systems.
Is deployment client 32-bit or 64-bit? We verified with 64-bit and it seemed to untar downloaded app without any errors. Could you kindly open a case with support and provide diag from client and server?
Also moved my apps out of C:\Program Files\Splunk\etc\deployment-apps on the deployment server, and confirmed that the forwarder deleted it after checking in. Then I moved the files back into etc\deployment-apps and those error messages appeared on the forwarder.
Next, I installed a 64bit forwarder on Server 2003 R2 x64, and got the same errors in my splunkd.log as the 32bit server.
This is a 32bit client on a 32bit OS (Windows Server 2003 R2). Will open a case, thanks.
gunzip and untar of those files should be built into the Universal Forwarder. This seems like a bug unless there's some other broken configuration. You may need to contact Support to help diagnose this.