No internal logs received?

[Alixfire]

Hello,

Can anyone help me out with the problem of client connected to deployment server but unable to send logs of any kind. No internal logs and no monitored logs are being received at indexer even though phone home is happening and apps being deployed at the client.

Thank you.

[richgalloway]

The indexer and the deployment server (DS) should be different instances so connectivity to one does not imply connectivity to the other.

Verify the DS is delivering the right outputs.conf file to the client.  If SSL is used, make sure that file contains the SSL password and the right certificates are also sent to the client. 

Verify firewalls allow connections from client to indexer. 

Check the splunkd.log file on the client for messages that might explain the cause of the problem.

Make sure the indexer has port 9997 (or your chosen port for receiving data) open.  See Settings->Forwarding and Receiving.

[Alixfire]

Hello,

Thank you for the reply.

I tried the things you mentioned and telnet is also working fine for indexer and DS on the specified ports. Also appropriate permissions are on place for the splunk user on servers.  While all are working fine logs are not being forwarded. Any alternate things to look out for this issue. @richgalloway.

[richgalloway]

Did you read splunkd.log on the client?  If the client is unable to send data to the indexer then there should be a lot of messages in the log complaining about that.  That assumes the client has data to send, of course.