Splunk Universal Forwarder -- installing additional roles?

[cutright_jm]

I had installed the Universal Forwarder 6.5.1 a while back and set it to connect to a deployment server / Splunk instance. All I wanted it to do was be a forwarder. However, upon a Nessus scan of the host, I see that it also has the following server roles: deployment_client and license_master, as well as a web interface running on 8089. Is this a standard thing, or did I do something incorrectly? In add/remove programs it is showing installed as "UniversalForwarder".

URL : https://windowshost.mydomain.com:8089/
Version : 6.5.1
License : Enterprise
Management API : 1

Server Roles :
- deployment_client
- license_master
- universal_forwarder

[lloydknight]

Hello cutright_jm

Try binding Splunk's port 8089 to an IP to address the web interface:
Kindly see this documentation below:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/BindSplunktoanIP

As for the deployment_client role, i believe you have created a deploymentclient.conf which the Forwarder is reporting to the Deployment Server. You can verify this by checking the Forwarder Management on the Deployment Server.

You can just directly set the Forwarder to forward logs to the Indexer by just configuring its outputs.conf. The only downside to this one is you can't push apps to the Forwarder.

Hope it helps!

Thanks!

[richgalloway]

Those additional roles are not (much of) a concern.
Any instance that connects to a Deployment Server is a deployment client.
Forwarders don't use license so it doesn't matter if it's set up as a license master (which is the default, IIRC).
Port 8089 is the management port. Splunk uses HTTP to communicate among instances, which is why Nessus says there's a web interface there. If this troubles you (or your management), consider implementing firewall rules that allow only Splunk servers to access that port.