Getting Data In

How to restart a universal forwarder remotely via deployment server?

koshyk
Super Champion

We are facing a few issues whereour endpoints (clients) may have the Splunk service stopped.
Can we force a restart of the Universal forwarder (agent) "splunk service" or "splunk" from our deployment server?

Currently, we are asking the support team of the respective application team to do it for us, but would be great if we can manage the agents ourselves. (BTW the agents have local accounts in the clients)

0 Karma
1 Solution

adayton20
Contributor

I do not know of a way to force restart a deployment client once it already stopped. After all, if the service is stopped, it can’t connect to the deployment server in the first place.

I used to work in an environment where we monitored for critical services stopping in Splunk, the Splunk service being one of them. Perhaps it would be a good idea to investigate why the service is stopping to verify nothing malicious is occurring. Should be Event ID 7036. You could do what we did and use a powershell script to restart the service should it stop. We ran the script in the background as a scheduled task every 15 minutes.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi koshyk,
No you cannot if your Forwarder is stopped!
you can restart a Forwarder only if it runs and you deploy a TA on this Forwarder.
probablu the only way is a remote script shell.
Bye.
Giuseppe

0 Karma

adayton20
Contributor

I do not know of a way to force restart a deployment client once it already stopped. After all, if the service is stopped, it can’t connect to the deployment server in the first place.

I used to work in an environment where we monitored for critical services stopping in Splunk, the Splunk service being one of them. Perhaps it would be a good idea to investigate why the service is stopping to verify nothing malicious is occurring. Should be Event ID 7036. You could do what we did and use a powershell script to restart the service should it stop. We ran the script in the background as a scheduled task every 15 minutes.

koshyk
Super Champion

+1 thanks for the tip of powershell script. hopefully will get more ideas from other people

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...