What is the deployment polling data meaning for ?

[sunrise]

Hi splunkers,

Yesterday, I was monitoring the splunk_access.log and found the log messages
that deployment clients poll to the deployment server, both platforms are Windows Server, Splunk V5.

The messages in one poll are below.

172.XX.XX.XXX - - [29/Oct/2013:02:56:31.939 +0900] "POST /services/broker/phonehome/connection_172.XX.XX.XXX_8089_splk23_splk23_41EB9A91-5859-4029-A6FE-D7C46CDEB486 HTTP/1.0" 200 278 - - - 219ms
172.XX.XX.XXX - - [29/Oct/2013:02:56:31.721 +0900] "POST /services/broker/phonehome/connection_172.XX.XX.XXX_8089_splk23_splk23_41EB9A91-5859-4029-A6FE-D7C46CDEB486 HTTP/1.0" 200 995 - - - 219ms

Now I have a question that what each messages which have different bytes are meaning for ?
And I also found that sometimes 995 bytes data got lost, or not the normal interval.
Is it a problem, or not ?

Thank you for your help.

[yannK · Accepted solution]

This is the phonehome call from the deployment-clients calling the deployment-server.
They report with their IP, hostname, the clientname and GUID for the matching with the serverclass.conf.

Each client tries to connect after the phonehome interval modulo some random seconds.
i do not know why the bytes change.

[yannK]

on 6.0 the clients are not using strictly the "phoneHomeIntervalInSecs", they add some randomness to it avoid peaks of connections.

[sunrise]

Thank you, yannK.
So you think that phonehome call is based on the attributes "phoneHomeIntervalInSecs" in deploymentclient.conf,
but client connections from clients to server are slightly late.

Universal Forwarders in Windows Server post two kinds of bytes like above log, but in Linux don't do that...