Deployment Architecture

Do we need to reload the deployment server before phonehoming takes place?

abhi04
Communicator

Hello All,

I have below questions on the reload command and phonehoming which I need to confirm:
1. Both the deploy reload command and the phonehoming changes the configs in forwarders(clients) but both have a different approach. The reload command will push the changes to forwarders(clients) without any splunk start but the phonemhoming willcheck for any changes in the configs in the deployment server and if there are changes will poll the changes and restart the forwarder(clients) and apply changes?
2. Should we run the reload command before or after phonehoming?

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Allow me to clear up some confusion.

First, the reload command does NOT push changes to clients. The reload command tells the deployment server to re-read its serverclass.conf file.

Second, the deployment server does not PUSH apps to clients. Clients download apps from the DS when they phone home and find an app is different from what it has.

Finally, from the DS perspective, phoning home is a random event. It's difficult to time something to happen before or after phoning home. Don't be concerned about it. Any changes on the DS will be picked by the clients then next time they phone home.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Allow me to clear up some confusion.

First, the reload command does NOT push changes to clients. The reload command tells the deployment server to re-read its serverclass.conf file.

Second, the deployment server does not PUSH apps to clients. Clients download apps from the DS when they phone home and find an app is different from what it has.

Finally, from the DS perspective, phoning home is a random event. It's difficult to time something to happen before or after phoning home. Don't be concerned about it. Any changes on the DS will be picked by the clients then next time they phone home.

---
If this reply helps you, Karma would be appreciated.

abhi04
Communicator

@richgalloway Thanks for answering.

I went through the splunk doc (https://docs.splunk.com/Documentation/Splunk/8.0.4/Updating/Updateconfigurations) and its mentioned as below:

Reload the deployment server
After you edit the content of an app, you must reload the deployment server so that the deployment server learns of the changed app. It then redeploys the app to the mapped set of clients.

To reload the deployment server, use the CLI reload deploy-server command:
splunk reload deploy-server
The command checks all apps for changes and notifies the relevant clients.

I am confused because both things are mentioned
1. It redeploys the app to the mapped clients
2. The command checks all apps for changes and notifies the relevant clients.

I just wanted to understand how this works. I would appreciate your views on this.

Thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, the documentation does say the DS deploys apps, which it does, in principle. In actuality, the client is the one that initiates the action, with DS acting as the repository from which clients download apps. The DS uses the serverclass.conf file to determine which apps each client is allowed to have.

---
If this reply helps you, Karma would be appreciated.

abhi04
Communicator

Thanks for the explanation

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...