Deployment Architecture

Deployment clients logging

Starlette
Contributor

Is the component in _internal dropped for the deployment clients connects ( component DeploymenServer) ?

I believe that to get the client you could use :

index=_internal source=splunkd.log component="DeploymentServer" | dedup hostname | table hostname

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

The clients themselves will log events as DeploymentClient (typically when the server has issued splunk reload deploy-server to update the class definitions. It will also log DeployedApplication when the client has downloaded and installed a new app.

The server will log PackageDownloadRestHandler messages in splunkd.log (including the IP of the client) when a client downloads an application. The server also logs client connections (even when no apps are being deployed) in splunkd_access.log, with the 'phonehome' keyword. Information about the client is logged here, such as its IP, server name (as defined in server.conf), etc.

Starlette
Contributor

yeah, or is ariving at the deploymentbox, i can control them now but was focus on the component deploymentserver which is gone in splunk.d log

0 Karma

sowings
Splunk Employee
Splunk Employee

Components are gone? Perhaps I misunderstood the nature of your question? What exactly are you trying to figure out? Whether an individual client has connected?

0 Karma

Starlette
Contributor

cool, indeed it looks like the components are gone,,,,guess time for a deployment config monitor?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.