Deployment Architecture

Why am I unable to connect my indexers and search head to the license master with error "path=/masterlm/usage: invalid signature on request from ip=xxx.xxx.xxx.xxx"?

thomas_forbes
Communicator

I cannot switch my Splunk Indexer group and Search head to communicate with my license master. Currently I have the Master node serving as my License Master. I was able to get my deployment server to identify and respond to the License master, but that is it.

Here is the error message I am receiving:

Failed to contact license master:  reason='WARN:  path=/masterlm/usage:  invalid signature on request from ip=xxx.xxx.xxx.xxx'.....

This message is just about completely meaningless to me.

Thank you for your input,

Tom Forbes

0 Karma
1 Solution

masonmorales
Influencer

That error indicates that the license master clients (i.e. your indexers and search heads) have a different pass4SymmKey configured than what is configured on the license master.

In server.conf on each client, edit the [general] stanza with
pass4SymmKey = yoursecuritykey

Then, restart Splunk. If you don't know what the pass4SymmKey is set to on your license master, change it, restart the license master, then make it the same on all of your LM clients and restart them as well.

View solution in original post

thomas_forbes
Communicator

All of my pass4SymmKey settings are identical. I have no idea what is going on.

0 Karma

thomas_forbes
Communicator

So what could the problem be if my Pass4SymmKeys all match the license master and I am still getting the error above when trying to convert each node from it's own master to a slave to the license master?

0 Karma

thomas_forbes
Communicator

Nothing has changed I am still getting the same error message.

0 Karma

masonmorales
Influencer

That error indicates that the license master clients (i.e. your indexers and search heads) have a different pass4SymmKey configured than what is configured on the license master.

In server.conf on each client, edit the [general] stanza with
pass4SymmKey = yoursecuritykey

Then, restart Splunk. If you don't know what the pass4SymmKey is set to on your license master, change it, restart the license master, then make it the same on all of your LM clients and restart them as well.

thomas_forbes
Communicator

All of my pass4SymmKey settings are identical to the License Master and I am still having no luck adding the indexer nodes or the Search head to my master license. I have no idea what is going on and it seems there is some sort of flaw.

Also, which node is generally considered the License Master (Search head, Master node)?

Tom Forbes

0 Karma

masonmorales
Influencer

I use a separate VM for my LM but you could put it anywhere. I have seen it on both CMs and SHs. I think you may need to open a support case for your question.

0 Karma

thomas_forbes
Communicator

What else could be causing this error message?

Failed to contact license master: reason='WARN: path=/masterlm/usage: invalid signature on request from ip=xxx.xxx.xxx.xxx'.....

Like I have stated before above, all of the pass4SymmKeys are identical to the master license server. Everytime I try to convert one of my indexers to a slave indexer it does not work ever. It makes me think something is really wrong with how Splunk does it's licensing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...