Deployment Architecture

migrating production deployment server to new machine

Chiranjeev
Explorer

Hi All,

 

we have our server that's reaching EOL and is currently a deployment server for 4k clients and we need to migrate to new machine.

can anyone help to tell the steps to test the connectivity with new ds and then ultimately migrate to new ds server 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To test connectivity, first start the new DS.  Then sign in to a few DS clients and use your favorite networking tool to ensure the client can reach the new DS's management port (usually 8089).

The cutover steps depend on your configuration.  In an ideal world, DS clients use a DNS name to access the DS.  In that case, it's just a matter of changing the DNS to point to the new server.

Chances are you do not live in that world, however.  The next-best scenario is you have an app ("org_all_deploymentclients", for example) deployed to all clients that includes a deploymentclient.conf file.  If that's the case then just update the file with the new DS name/address and clients will pick it up and switch over automatically as they phone home.

In the worst case, the clients have the DS specified in $SPLUNK_HOME/etc/system/local/deploymentclient.conf .  That file cannot be overridden by an app so you're a little stuck.  There are a few options:

  1. Manually sign in to each box and delete $SPLUNK_HOME/etc/system/local/deploymentclient.conf  so the org_all_deploymentclients app can provide the right info.
  2. Use automation to do the above
  3. Create an app containing a script that deletes the $SPLUNK_HOME/etc/system/local/deploymentclient.conf  file and deploy that script to each client.  Then the client can download org_all_deploymentclients and connect to the new DS.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To test connectivity, first start the new DS.  Then sign in to a few DS clients and use your favorite networking tool to ensure the client can reach the new DS's management port (usually 8089).

The cutover steps depend on your configuration.  In an ideal world, DS clients use a DNS name to access the DS.  In that case, it's just a matter of changing the DNS to point to the new server.

Chances are you do not live in that world, however.  The next-best scenario is you have an app ("org_all_deploymentclients", for example) deployed to all clients that includes a deploymentclient.conf file.  If that's the case then just update the file with the new DS name/address and clients will pick it up and switch over automatically as they phone home.

In the worst case, the clients have the DS specified in $SPLUNK_HOME/etc/system/local/deploymentclient.conf .  That file cannot be overridden by an app so you're a little stuck.  There are a few options:

  1. Manually sign in to each box and delete $SPLUNK_HOME/etc/system/local/deploymentclient.conf  so the org_all_deploymentclients app can provide the right info.
  2. Use automation to do the above
  3. Create an app containing a script that deletes the $SPLUNK_HOME/etc/system/local/deploymentclient.conf  file and deploy that script to each client.  Then the client can download org_all_deploymentclients and connect to the new DS.
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...