Deployment Architecture

upgraded to 4.2, now deployment clients fail to connect to deployment-server

tpsplunk
Communicator

on tuesday i upgraded my deployment server, my searchhead and my 3 indexers from 4.1.6 to 4.2. I have not updated my LWFs. on my searchhead, indexers and LWF i now see the following error:

03-22-2011 16:28:50.591 WARN DeploymentClient - Unable to send phonehome message to deployment server. Error status is: rejected

the servers can connect to the deployment server listening port so it doesn't appear to be a network issue:

[splunk@indexer01~]$ telnet search01 8090 Trying x.x.x.x... Connected to search01 (x.x.x.x). Escape character is '^]'. ^]

how do I fix this? are there any debug logs i can turn on/look at to get a better idea of what exactly is failing?

Tags (1)
1 Solution

Jason
Motivator

I have noticed that the 4.2 Forwarder license does not seem to allow Deployment Server to run:

$ ./splunk list deploy-clients
Current license does not allow the requested action
$ ./splunk reload deploy-server
Current license does not allow the requested action

On the logs of a client:

WARN DeploymentClient - Unable to send phonehome message to deployment server. Error status is: rejected

View solution in original post

0 Karma

Jason
Motivator

I have noticed that the 4.2 Forwarder license does not seem to allow Deployment Server to run:

$ ./splunk list deploy-clients
Current license does not allow the requested action
$ ./splunk reload deploy-server
Current license does not allow the requested action

On the logs of a client:

WARN DeploymentClient - Unable to send phonehome message to deployment server. Error status is: rejected
0 Karma

tpsplunk
Communicator

i forgot to update this with the solution, but jason is right. the 4.2 forwarder license does not allow the deployment server to run. I had to add the deployment server to my 4.2 license pool and it started successfully after that.

0 Karma

tpsplunk
Communicator

support noted that in my deployment sever splunkd_access.log I have lots of lines like this: "POST /services/broker/phonehome/ HTTP/1.0" 404 200 - - - 41ms. which means my deployment clients are trying to POST to /services/broker/phonehome/, but are getting a 404 (file not found) response. still digging into what that means and how its happening.

0 Karma

tpsplunk
Communicator

i also installed the 4.2 universal forwarder on a couple hosts and they also get the same error when trying to connect to the deployment server.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...