universal forwarder bug after update to V6

[Ed_Alias]

Hello,

since i updated my UF from version 5 to 6 they seem to loop on loading the serverclasses :

it seems like a loop keeps deploying new serverclass

03-27-2014 11:10:54.297 +0100 INFO DeployedServerclass - name=SC_windows_IIS_test Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_IIS_test'
03-27-2014 11:10:54.297 +0100 INFO DeployedServerclass - name=SC_windows_iis Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_iis'
03-27-2014 11:10:54.297 +0100 INFO DeployedServerclass - name=SC_windows_std_602 Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_std_602'
03-27-2014 11:10:54.297 +0100 INFO DC:UpdateServerclassHandler - Changed state from=HandlingPhonehome to=Phonehome
03-27-2014 11:10:54.344 +0100 INFO DC:UpdateServerclassHandler - Changed state from=Phonehome to=HandlingPhonehome
03-27-2014 11:10:54.344 +0100 INFO DeployedServerclass - name=SC_windows_IIS_test Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_IIS_test'
03-27-2014 11:10:54.344 +0100 INFO DeployedServerclass - name=SC_windows_iis Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_iis'
03-27-2014 11:10:54.344 +0100 INFO DeployedServerclass - name=SC_windows_std_602 Reload; workingDir='C:\Program Files\SplunkUniversalForwarder\var\run\SC_windows_std_602'
03-27-2014 11:10:54.344 +0100 INFO DC:UpdateServerclassHandler - Changed state from=HandlingPhonehome to=Phonehome


[eugenezxq]

Hi did you guys manage to resolve this issue? Am getting this right now.

[sbennacer_splun · Accepted solution]

Hi,
The behavior you see is a Bug. i.e
SPL-78499:DC (deployment client) logging too verbose at default log levels
This Bug is expected to be addressed in coming releases 6.1 .
Kind Regards

[Ed_Alias]

yep thank you sbennacer !

[Ed_Alias]

what is precisely the (a) forwarder configs ?

[Ed_Alias]

and SC_windows_std_602 input.conf is :

[default]
evt_dc_name = \\server.domain

[WinEventLog:Application]
disabled = 0

[WinEventLog:Security]
disabled = 0

[WinEventLog:System]
disabled = 0'

[Ed_Alias]

SC_windows_IIS_test is not used anymore (it is empty)

here is the input for the conf_windows_IIS :

[monitor://L:\com\folder\...\*.log]
sourcetype=iis

index = test_index

[monitor://L:\com\folder\...\...\*.log]
sourcetype=iis

index = test_index


[monitor://L:\com\folder\...\...\...\*.log]
sourcetype=iis

index = test_index
recursive = true

[koshyk]

can you also update here .. (a) forwarder configs and (b) serverclass config