Deployment Architecture

debugging deployment server

a212830
Champion

Hi,

Are there any logfiles that show the deployment server attempting to push changes out (or, on the other side, in?) I made some changes, but they are not getting pushed out. The connection between the server and client is there, but nothing gets pushed when I reload the server.

Tags (1)
0 Karma

lguinn2
Legend

Yes, and they are all splunked. You can find them by searching the _internal index. Additionally, forwarders send their key logs to the indexer, so you see both "sides" of the deployment server / deployment client interaction.

Here are some searches that I like to use:

index=_internal component=deploy* OR component=serverclass sourcetype=splunkd 
| fields host component log_level message
| table _time host component log_level message

index=_internal sourcetype=splunkd component=Metrics group=ds_connections* |
rename ip as deploymentClient mgmt as mgmtPort |
fields deploymentClient mgmtPort utsname dsevent |
table _time deploymentClient mgmtPort utsname dsevent 
0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Community Content Calendar, August edition

In the dynamic world of cybersecurity, staying ahead means constantly solving new puzzles and optimizing your ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...