Deployment Architecture

Why is my 6.2 license slave not working with my 6.1.4 license master?

jdastmalchi_spl
Splunk Employee
Splunk Employee

I have License master splunk version 6.1.4. I have now installed 6.2 version on some servers and these servers don't work as license slaves with 6.1.4 license master.
Is there a version incompatibility? Does the license master need to be the same version?
I get these errors on the license master:
11-18-2014 09:38:42.363 +0000 ERROR LMHttpUtil - signature mismatch between computed and actual for uri /services/masterlm/usage
11-18-2014 09:38:42.363 +0000 ERROR LMMasterRestHandler - path=/masterlm/usage: invalid signature on request from ip=10.73.1.206

1 Solution

jdastmalchi_spl
Splunk Employee
Splunk Employee

in server.conf you have a key "pass4SymmKey" under the General stanza "[general]" this is not to be mistaken with the pass4SymKey used for clustering. This pass4SymmKey is used in the license master/slave communication. So you may have set this password in $SPLUNK-HOME/system/local/server.conf

[general]
pass4SymmKey = test

If you set this in 6.1.4 after restarting splunk it saves it as plain text and does not get encrypted, however the same password in 6.2 after restart will get encrypted and will look something like this "pass4SymmKey = $1$W5xMFCIb8FGj”.

As long as you understand this and respect the difference it will work, if you suspect this is wrong and copy paste the encrypted pass to the license master this will break the communication as the behaviorrs are different.

View solution in original post

dkolekar_splunk
Splunk Employee
Splunk Employee

A license master must always be of equal or later version than its license slaves.

alt text

splunkreal
Motivator

Hello,

Our test environment uses production LM and we never had any compatibility issue upgrading first test nodes :

6.2.3 > 6.5.2

6.5.2 > 7.1.4

7.1.4 > 7.3.4

We plan to upgrade 7.3.4 to 8.2.2, any possible issue?

Thanks

 

 

* If this helps, please upvote or accept solution if it solved *
0 Karma

jdastmalchi_spl
Splunk Employee
Splunk Employee

in server.conf you have a key "pass4SymmKey" under the General stanza "[general]" this is not to be mistaken with the pass4SymKey used for clustering. This pass4SymmKey is used in the license master/slave communication. So you may have set this password in $SPLUNK-HOME/system/local/server.conf

[general]
pass4SymmKey = test

If you set this in 6.1.4 after restarting splunk it saves it as plain text and does not get encrypted, however the same password in 6.2 after restart will get encrypted and will look something like this "pass4SymmKey = $1$W5xMFCIb8FGj”.

As long as you understand this and respect the difference it will work, if you suspect this is wrong and copy paste the encrypted pass to the license master this will break the communication as the behaviorrs are different.

cirkit1
Explorer

Can you just copy the encrypted pass4symmkey string to the other license slaves nodes?

Or do you have to have the plain text version and enter into the pass4symmkey key, restart, and let it encrypt it?

0 Karma

cirkit1
Explorer

IF i were to reset the pass4symmkey in the [general] stanza on the license master, will it have any impact to the pass4symmkey in the [clustering] stanza?

just want to make sure these are 2 separate pass4symmkey for 2 different purposes (licensing vs clustering) and hoping one does not affect the other.

0 Karma

j0shrice
Path Finder

Was there any update here if it will affect say a Deployer's connection. We are getting this error only on the deployer

0 Karma

andrey2007
Contributor

As I understood from answer in case of 2 clusters which use same License master you must have same pass4SymmKey in general stanza in both clusters? And what is about reverse compatibility when I have 6.2 License master with specified pass4Symmkey and 6.1.5 slaves without such parameter?

0 Karma

thomas_forbes
Communicator

I had the same issue, but this suggested fix did nothing to help. I am not sure what is going on.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...