We are in the process of migrating a lot of hosts to report to a new deployment server. The deploymentclient.conf file was changed to reflect the IP address of the new deployment server and the hosts phones home to the new new deployment server and we verify logs coming in. Then after some time, something modifies the deploymentclient.conf file to have the hosts report back to the old deployment server. We cannot seem to figure out what is making this change. We have uninstalled and reinstalled the universal forwarder on a test client this past week and everything was fine. Then the same thing happened yesterday and the host is reporting back to the old deployment server. This is happening on some hosts, not all. The ones that do not have this problem are reporting to the same new deployment server with no problems.
Any suggestions would be helpful
Do you have a third-party tool like Ansible or BigFix that might be restoring the file to what it thinks it should be?
Do you have multiple deploymentclient.conf files in different apps in your DS? If so, make sure they're all updated with the new DS's address. Better yet, refactor the apps so you have only one deploymentclient.conf file.
Suggestion: use btool to find out exactly which deploymentclient.conf is getting overwritten.
# /opt/splunkforwarder/bin/splunk btool deploymentclient list --debug /opt/splunkforwarder/etc/apps/myapp/default/deploymentclient.conf [deployment-client] /opt/splunkforwarder/etc/system/local/deploymentclient.conf clientName = my_fwdr /opt/splunkforwarder/etc/apps/myapp/default/deploymentclient.conf phoneHomeIntervalInSecs = 500 /opt/splunkforwarder/etc/system/local/deploymentclient.conf [target-broker:deploymentServer] /opt/splunkforwarder/etc/system/local/deploymentclient.conf targetUri = mydeploymentserver.mycompany.com:1234