What timelimit does the Administrative console use to evict deploy-clients?

[las]

Hi.

I have been unable to find the time the deployment server uses to evict clients that it haven't heard from.

I would like to increase the phoneHomeIntervalInSecs to more than 60 secs. but it seems to have the undesired side effect, that I'm unable to reliable see the deployment-clients in the Deployment server class status.

Is there a way to configure a longer keep time for the Deployment server class status?

Kind regards.

las

[las]

I have submitted this issue as a bug, and development will look into it.

[lguinn2 · Accepted solution]

The deployment clients are still valid clients, even though they don't show up in the status. I know people that have set the phone home interval to 300 or 600 seconds, and it works.

I think that a better way to look at the deployment server activity is to examine the _internal index. Since the forwarders send at least some of their internal logs to the indexer, you can see both the deployment client and the deployment server sides of the interaction. Here are two searches that will give you a lot of information about what is happening:

---

index=_internal component=deployed* OR component=serverclass sourcetype=splunkd 
| fields host component log_level message
| table _time host component log_level message

---

index=_internal sourcetype=splunkd component=Metrics group=ds_connections* |
rename ip as deploymentClient mgmt as mgmtPort |
fields deploymentClient mgmtPort utsname dsevent |
table _time deploymentClient mgmtPort utsname dsevent 

---

You can run these over any time period. I usually look at the last hour. Of course, you can make your own searches, too. And for a forwarder that is not yet sending its logs to the indexer, you can look at the splunkd.log file manually on the forwarder itself.

[lguinn2]

AFAIK, there is no way to do that.

Unless you look at the serverclass.conf directly.

[las]

Thanks for the searches, they give a lot of info.

I would still like to have the management show the correct info, even though they are still valid clients.

I use the list to see what clients are in which serverclasses, and what apps are deployed to them - regardless of time...

Kind regards