Deployment Server: Debugging: which logs hold which data?

[krussell101]

I need some general guidance on debugging deployment server/client issues.

I just configured the deployment server today and am trying to get it working with a single client.

It's sort of half way working. Some stuff is getting through but not other stuff.

Are there log(s) on either the server or the client that include app configs that are sent to a client? I'd like to see what the client is getting sent / receiving.

Here's what I've found so far:

I have found "group=ds_&" entries in metrics.log.

I found errors in splunkd.log when an application defined in serverclass.conf did not have its requisite directory in apps/deployment-apps. But nothing when apparently all is working as it should from the deployment server's perspective.

I have found connection entries in the deployment server's splunkd_access.log.

There has to be more of a breadcrumb trail than this.

Happy to debug but need some guidance in where to look.

Thanks

[jbsplunk · Accepted solution]

The log you want to examine is splunkd.log in $SPLUNK_HOME/var/log/splunk/. You can get more information if you turn up debugging in log.cfg on the Deployment client and server. In $SPLUNK_HOME/etc/, you'll find log.cfg. On the deployment server, change

category.DeploymentServer=WARN

to

category.DeploymentServer=DEBUG

On the Deployment Client, change

category.DeploymentClient=WARN

to 

category.DeploymentClient=DEBUG

Then restart both the client and server instances, and you'll get quite a bit more information on what is occurring.

Best Regards,
Joshua Backing
Splunk Support

[krussell101]

You are my hero. Thank you!

Don't freak. I won't start stalking you or anything.