Deployment Architecture

deployment server debug..

a212830
Champion

Hi,

I'm trying to push out some new configs via the deployment server, but they aren't working. I turned on debug on the client, and I see the following. Can someone decipher this for me?

02-02-2013 22:12:43.143 -0500 DEBUG DeploymentClient - PhoneHomeThread woke up
02-02-2013 22:12:43.143 -0500 DEBUG DeploymentClient - Send phone home
02-02-2013 22:12:43.466 -0500 DEBUG DeploymentClient - Current state: 3, new state: 4
02-02-2013 22:12:43.466 -0500 DEBUG DeploymentClient - Phone home recvd reply: <?xml version="1.0" encoding="UTF-8"?>\n\n
02-02-2013 22:12:43.466 -0500 DEBUG DeploymentClient - DeploymentClient is about to reload a new manifest....
02-02-2013 22:12:43.466 -0500 DEBUG DeploymentClient - DeploymentClient is done reloading...
02-02-2013 22:12:43.466 -0500 DEBUG DeploymentClient - Current state: 4, new state: 3

Tags (1)
0 Karma

lguinn2
Legend

Okay, it looks like you have set

restartSplunkd = False

in serverclass.conf for this client (or perhaps that is the default for this client). So when the client downloads the app, it doesn't restart splunkd. Therefore, the new app/configs do not take effect. You might want to change that.

You might not have needed to turn on debug. If you had searched the _internal index, you would probably have found much the same thing. Or at least you would have been able to see that the app was being deployed. I like to use a search like this:

index=_internal deployedapplication OR serverclass OR packagedownloadresthandler sourcetype=splunkd 
| table _time host component log_level message

To test that this was the only problem, go to the client and see if the app appears. If yes, then restart splunkd. If that fixes the problem, then this was it!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...