Deployment Architecture

Sophos Central 1.05 Are there different setup considerations between running on a single server vs. distributed environment.

Splunk Employee
Splunk Employee

We've configured Sophos Central v 1.05 on our dev server and everything works correctly. When we move the same configuration to our production distributed architecture, it fails. We see multiple errors "ERROR ExecProcessor - message from "phython /opt/splunk/etc/apps/sophos_central/bin/", and nothing ever hits the firewall. I've seen other questions posted about errors with and we've verified that those are not our problem. Any Ideas?

0 Karma

Ultra Champion

When you say to have moved it to a distributed architecture, what do you mean?

You would want to run the app with a configured account on a single machine like a heavy forwarder, or maybe on your search head.
Be sure to only configure 1 server to perform the collection, lest bad things (like duplication) may happen.

If your installing on multiple servers, it will nag you on each to run the setup - to bypass this add "is_configured = true" in the local/app.conf .

Maybe i'll add that option in 1.0.6

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...