I have been unable to find the time the deployment server uses to evict clients that it haven't heard from.
I would like to increase the phoneHomeIntervalInSecs to more than 60 secs. but it seems to have the undesired side effect, that I'm unable to reliable see the deployment-clients in the Deployment server class status.
Is there a way to configure a longer keep time for the Deployment server class status?
The deployment clients are still valid clients, even though they don't show up in the status. I know people that have set the phone home interval to 300 or 600 seconds, and it works.
I think that a better way to look at the deployment server activity is to examine the
_internal index. Since the forwarders send at least some of their internal logs to the indexer, you can see both the deployment client and the deployment server sides of the interaction. Here are two searches that will give you a lot of information about what is happening:
index=_internal component=deployed* OR component=serverclass sourcetype=splunkd | fields host component log_level message | table _time host component log_level message
index=_internal sourcetype=splunkd component=Metrics group=ds_connections* | rename ip as deploymentClient mgmt as mgmtPort | fields deploymentClient mgmtPort utsname dsevent | table _time deploymentClient mgmtPort utsname dsevent
You can run these over any time period. I usually look at the last hour. Of course, you can make your own searches, too. And for a forwarder that is not yet sending its logs to the indexer, you can look at the splunkd.log file manually on the forwarder itself.
Thanks for the searches, they give a lot of info.
I would still like to have the management show the correct info, even though they are still valid clients.
I use the list to see what clients are in which serverclasses, and what apps are deployed to them - regardless of time...