Hi
In the Deployment Server (DS):
- I copied an app to the /opt/splunk/etc/deployment-apps/
In the Universal Forwarder (UF), I configured it as a Deployment Client:
- splunk set deploy-poll 10.10.10.117:8089
Telnet from the UF to DS in 8089 works fine.
In the DS, I get the errors
"DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected"
Any ideas?
Thanks in advance
I have the same problem where i can ping and telnet to deployment server but still i am receiving the error message.. Any possible solutions to solve this?
@vinesh were you able to solve the issue? If yes, how ?
@snaikwade1 No, even after trying the possible solutions given by others it still seems to the same error.
But for other clients i didn't face this issue.
The Possible issue is the firewall is blocking the management port . if the port is open then the issue will be resolved
I have same situation. But I can ping and telnet 8089 my deployment server from forwarder host and I have same error in var/log/splunk/splunkd.log on forwarder side. How can I do further troubleshooting?
Although this log is INFO
severity in splunkd
log, it is actually an ERROR
. This log is saying that the deploymentclient.conf
configuration for the Deployment Server is unreachable from your host. First, figure out which deploymentclient.conf
file is in control (you can use btool
for this); it is probably in $SPLUNK_HOME/etc/system/local/
(this is not where it should be, but it is usually where people start out). If ICMP is allowed, you can start by trying to ping
the IP address for the Deployment Server found in that file. In any case, from there it is a networking exercise. Maybe you don't have a route defined. Maybe you have a firewall blocking it (port 8089). Once you point it to the right place and open up the communication pathway, this log will stop. It would help if you provided the contents of the deploymentclient.conf
file.
I have the same error in the splunkd.log file.
The ssh -v DS-IPaddress whos Connection established.
Any other suggestion how to further troubleshooting the issue ?
Incredible thing just happened, I brought my pc home and connected to my company network using the vpn.... suddenly th Client appeared in the Forwarder Management
So somehow there is network problem whith my office network that I am not aware of...
Hey @TiagoTLD1 , come back here and either post a new answer or find the best/closest one and click Accept
to close out the question.
@woodcock I have similar issue in my instance and telnet is fine from both server to DC and vice versa. But still i'm getting the same error in splunkd.log and not able to index new data. When i add some new information's in inputs.conf file its not showing in splunk UI even after restarting splunk forwarder.
You are not making sense. This error has nothing to do with indexing or inputs.conf.
@woodcock looking back at your previous comment, i'm able to telnet form both ends so if its a connectivity issue then my connections are working fine but still im getting this error. How to solve this ?
Right, like I said, a connectivity problem.
@woodcock I am having the same issue only difference is when my UF attempts again after a few minutes HandShake is achieved and all the applicable apps are pulled down. This same pattern is happening across a significant number of endpoints. Any idea why that would be the case?
Did you setup a serverclass.conf? Or use the UI to create your serverclasses?
Hi.
Thanks for the response! Yes I did that too. Incredible thing just happened, I brought my pc home and connected to the network using the vpn.... suddenly th Client appeared!
Weird:
Thanks anyway!