Deployment Architecture

Deployment Clients not picking up config

dstambaugh
Explorer

Got a brand new install of 4.2 on a Windows 2008 R2 server. Set it up as a deployment server. Installed the unv forwarder on another Windows 2003 server, and pointed it to the first server as a deployment server.

It picked up the 2 server classes that it was supposed to, but couldn't implement them because it couldn't unarchive the tar.gz file that the configs are put into! from the unv forwarder server, here's the splunkd.log:

04-13-2011 17:38:22.482 -0400 INFO  DeployedApplication - Checksum mismatch 17827980805161142201 <> 635300122953481294 for app: WindowsEvents. It will be reloaded again from: indexer01.mycompany.com:8089/services/streams/deployment?name=default:Windows Forwarders:WindowsEvents
04-13-2011 17:38:22.482 -0400 INFO  DeployedApplication - Remote repository has resolved to: indexer01.mycompany.com:8089/services/streams/deployment?name=default:Windows Forwarders:WindowsEvents
04-13-2011 17:38:22.498 -0400 INFO  DeployedApplication - Downloaded url: indexer01.mycompany.com:8089/services/streams/deployment?name=default:Windows Forwarders:WindowsEvents to file: C:\Program Files\SplunkUniversalForwarder\var\run\Windows Forwarders\9dd4e0cd6fd8dcd6.tar.gz
04-13-2011 17:38:22.498 -0400 WARN  DeployedApplication - Computed checksum after downloading app: WindowsEvents does not match with expected remote checksum: 17827980805161142201 <> 635300122953481294
04-13-2011 17:38:22.498 -0400 WARN  DeployedApplication - Installing app: WindowsEvents to location: C:\Program Files\SplunkUniversalForwarder\etc\apps\WindowsEvents
04-13-2011 17:38:22.498 -0400 ERROR ArchiveFile - In archive 'C:\Program Files\SplunkUniversalForwarder\var\run\Windows Forwarders\9dd4e0cd6fd8dcd6.tar.gz': Unrecognized archive format
04-13-2011 17:38:22.498 -0400 WARN  DeployedApplication - There was a problem unarchiving C:\Program Files\SplunkUniversalForwarder\var\run\Windows Forwarders\9dd4e0cd6fd8dcd6.tar.gz due to Unrecognized archive format. The operation completed successfully.
04-13-2011 17:38:22.498 -0400 WARN  DeployedServerClass - There was a problem installing app: WindowsEvents for server class: Windows Forwarders

Do I have to install an app to be able to untar these files? Or should that ability be built into the splunk binaries for the unv forwarder?

Tags (3)
1 Solution

dstambaugh
Explorer

Resolved - the server classes I had specified contained spaces; you can't use spaces in the server class name. So I changed Windows Forwarders to WindowsForwarders and ran splunk reload deploy-server on the deployment server and all was well.

Also went through and deleted the 'Windows Forwarders' folder from C:\Program Files\SplunkUniversalForwarder\var\run on each Universal Forwarder server.

View solution in original post

dstambaugh
Explorer

Resolved - the server classes I had specified contained spaces; you can't use spaces in the server class name. So I changed Windows Forwarders to WindowsForwarders and ran splunk reload deploy-server on the deployment server and all was well.

Also went through and deleted the 'Windows Forwarders' folder from C:\Program Files\SplunkUniversalForwarder\var\run on each Universal Forwarder server.

iunderwood
Path Finder

Spaces in the server class will also result in the same problems on non-Windows systems.

0 Karma

jkerai
Splunk Employee
Splunk Employee

Is deployment client 32-bit or 64-bit? We verified with 64-bit and it seemed to untar downloaded app without any errors. Could you kindly open a case with support and provide diag from client and server?

0 Karma

dstambaugh
Explorer

Also moved my apps out of C:\Program Files\Splunk\etc\deployment-apps on the deployment server, and confirmed that the forwarder deleted it after checking in. Then I moved the files back into etc\deployment-apps and those error messages appeared on the forwarder.

Next, I installed a 64bit forwarder on Server 2003 R2 x64, and got the same errors in my splunkd.log as the 32bit server.

0 Karma

dstambaugh
Explorer

This is a 32bit client on a 32bit OS (Windows Server 2003 R2). Will open a case, thanks.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

gunzip and untar of those files should be built into the Universal Forwarder. This seems like a bug unless there's some other broken configuration. You may need to contact Support to help diagnose this.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...