We have a Splunk 6.1.4 License Master with several 6.1.x License Slaves. This configuration has been working well.
We have upgraded the License Slaves to version 6.2 while keeping the License Master at 6.1 and we now have communication issue between the slaves and master
The splunkd.log on the license master contains errors like:
ERROR LMMasterRestHandler - path=/masterlm/usage: invalid signature on request from ip= ERROR LMHttpUtil - signature mismatch between computed and actual for uri /services/masterlm/usage
We have tried changing the server.conf on the 6.2 LM to reflect 6.1 type setting eg
[sslConfig] sslVersions = * cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
We also stripped the custom apps out of the way in case there was some issue there.
This did not remedy the situation. Does anyone have any further suggestions?
Ok, I'm shocked but I fixed it:
For good measure, I upgraded to 6.1.4, the same level my indexers were on. I realized my license manager was on a 6.0* flavor. Sometimes that inconsistency can caused freaky things so I figured at the least I should fix that.
Then I threw down some btool to check what was up with my license server config.
btool server list --debug | grep -v system
showed me the I had erroneously configured the deployment server to send an app to the license master that contained a definition for the license target! (
After clearing up those shenanigans and restarting, I stopped seeing the error.
So...in my case, my issue was caused by bone-head config by yours truly.
On a side note, this may have caused my license usage to appear dramatically higher than it actually was - which makes sense if it was recursively posting to the license usage as a result of the config loop.,
If you have a support agreement with Splunk - could you raise a support ticket and mention SPL-93066 and this Splunk Answer in the case please?