OS for forwarder: Windows Server 2012
Splunk + Universal Forwarder version: 6
I'm trying to get my Universal Forwarder to contact the deployment server. The only "change" I have done during the installation is setting the deployment server in the msiexec.exe.
C:\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf:
[target-broker:deploymentServer]
targetUri = server:port
C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log:
10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Secure HTTP POST failed: Connect to=server:port timed out; exceeded 5sec
10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Could not obtain connection, will retry after=56 seconds.
10-24-2013 15:46:08.584 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:20.597 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:32.609 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:44.621 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:56.634 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
Log from the Splunk server
10-24-2013 12:33:42.634 +0200 WARN HttpListener - Socket error from X.X.X.X while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
Just for clearity: I can not see my client trying to phone home in under Forwarder management.
Have I left out something important in my forwarder configuration? Some suggestions on what I'm doing wrong?
