Deployment Architecture

Deployment Server: Debugging: which logs hold which data?

krussell101
Path Finder

I need some general guidance on debugging deployment server/client issues.

I just configured the deployment server today and am trying to get it working with a single client.

It's sort of half way working. Some stuff is getting through but not other stuff.

Are there log(s) on either the server or the client that include app configs that are sent to a client? I'd like to see what the client is getting sent / receiving.

Here's what I've found so far:

I have found "group=ds_&" entries in metrics.log.

I found errors in splunkd.log when an application defined in serverclass.conf did not have its requisite directory in apps/deployment-apps. But nothing when apparently all is working as it should from the deployment server's perspective.

I have found connection entries in the deployment server's splunkd_access.log.

There has to be more of a breadcrumb trail than this.

Happy to debug but need some guidance in where to look.

Thanks

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

The log you want to examine is splunkd.log in $SPLUNK_HOME/var/log/splunk/. You can get more information if you turn up debugging in log.cfg on the Deployment client and server. In $SPLUNK_HOME/etc/, you'll find log.cfg. On the deployment server, change

category.DeploymentServer=WARN

to

category.DeploymentServer=DEBUG

On the Deployment Client, change

category.DeploymentClient=WARN

to 

category.DeploymentClient=DEBUG

Then restart both the client and server instances, and you'll get quite a bit more information on what is occurring.

Best Regards,
Joshua Backing
Splunk Support

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

The log you want to examine is splunkd.log in $SPLUNK_HOME/var/log/splunk/. You can get more information if you turn up debugging in log.cfg on the Deployment client and server. In $SPLUNK_HOME/etc/, you'll find log.cfg. On the deployment server, change

category.DeploymentServer=WARN

to

category.DeploymentServer=DEBUG

On the Deployment Client, change

category.DeploymentClient=WARN

to 

category.DeploymentClient=DEBUG

Then restart both the client and server instances, and you'll get quite a bit more information on what is occurring.

Best Regards,
Joshua Backing
Splunk Support

krussell101
Path Finder

You are my hero. Thank you!

Don't freak. I won't start stalking you or anything.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...