Why does Splunk Universal Forwarders app disappears?

[maurobissante]

Hi,

we have several Universal Forwarders managed by a Deployment Server that occasionally "lose" applications and stop sending logs to Indexers and are no longer connected to the Deployment Server.
The only way to reconnect these UFs is to reinstall the connection apps to the DS manually by logging into the host, and then manage it again from the DS.
How does this happen? Is there any other way to reconnect these UFs to the DS without necessarily logging in?

Thanks,

Mauro

[isoutamo]

Hi

If I understood this right "lose" means that those apps are removed from UF?

If so you must find there reason for that removing from your UF's log files. Then you can see how to fix it. If those logs are not tampered you can check those after you have reinstalled DS connection to those nodes.

r. Ismo

[maurobissante]

Hi,

yes, it seems that these applications that we use to connect the UF to the Deployment Server and to send the logs get deleted by something (Splunk itself?) and the UF, of course, stops sending data and I can't reinstall them because the UF are no longer reachable from the DS.

This is the last log that Splunk received from this host:

08-01-2023 12:55:35.821 +0200 ERROR ExecProcessor [6648 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: no drive specifier found: '$windir\system32\dns\dns.log'

Any idea?

Thanks,

Mauro

[gcusello]

Hi @maurobissante ,

check the server classes to identify if this client is in more than one serverclass, instead on one.

Ciao.

Giuseppe

[maurobissante]

Hi @gcusello,

the host is in only one ServerClass with all the needed apps.

Thanks,

Mauro