Deployment Architecture

Why are UF's are disappearing from ForwarderManagement

Gene
Path Finder

Dear Splunkers,

Can you please assist with following problem:

We have more 20 UF's installed on windows machines, all of them have deployment server set, and were visible in Forwarder Management. But in some time all of them disappeared from FM and are appearing from time to time there.

I have tried to delete $SPLUNK_HOME/etc/instance.cfg  on several forwarders and restarted them but problem was not fixed.

 

Any ideas how to fix it and what can cause such strange behavior?

 

Regards,

Eugene

Labels (2)
Tags (2)
0 Karma
1 Solution

Gene
Path Finder

Thank you all for help. The problem was in SSL keys. I don't know what happened and how did they connect for the first time, but after I have created new keys and published to forwarders - problem disappeared.

 

BTW: no error in logs regarding SSL/

View solution in original post

0 Karma

Gene
Path Finder

Versions are the same.

btool and show deploy-poll show correct values.

telnet -  clarifying with client, cause do not have access to endpoints where forwarders are installed. 

and clients are in the same subnet, no VPN is used.

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should try from UF side to DS curl/telnet. All traffic between those are initiated by DC not DS!

curl -vkI https://<Your DS fqdn>:8089

Above command show HEAD part of response with debug information.

For security reason it's good to disable 8089 (management) port on UF unless you are regularly using it from scripts etc. on UF side.

How about host based firewalls?

r. Ismo 

Gene
Path Finder

I mean only one

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...