What is the Best practice for stateOnClient parameter on deployment-server and clients ?

[koshyk]

hi folks
just wanted to get your view on large scale installations of Universal Forwarders and apps in them.
What do you prefer? To use the default value of stateOnClient = enabled OR to use noop ?

I can see pros & cons of both approaches, but just wanted to check if you have seen issues on large scale installations.
I'm more tending towards noop these days with restartIfNeeded option, so all apps in the clients are in-line with master deployment-server. Any experience from you guys much appreciated.

[sloshburch · Accepted solution]

Hi! It always depends on what your goal is. I typically don't mess with that option and leave it as default. I've always seen it more as a feature for disabling an app at scale without removing it.

Remember that using the restartIfNeeded has some dependencies (see reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverclassconf).

What about normal DS use would imply the "clients would not be in-line with the master deployment server"? Are you referring to using multiple deployment servers (not recommended) or have I misunderstood the question?

[koshyk]

I meant to say, clients would always follow status in deployment server. So if I disable in dep-server, it will disable in Client too without needing to worry about the stateofClient

[sloshburch]

Yea, so long as you're referring to the config within app.conf. Exceptions to this would be the apps that come installed with splunk, you probably don't want to mess with those. Are we saying the same thing?