Installation

Failing to add a license-slave to a license-master since Splunk 6: invalid signature on request

yannK
Splunk Employee
Splunk Employee

I have a license-master on splunk 6.2.1, and try to connect a new license-slave to it, but get the following error:

Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=XX.XX.XX.XX'
Labels (1)
Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

It was a pass4symmkey difference between 2 servers of the same deployment.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Serverconf

see in $SPLUNK_HOME/etc/system/local/server.conf

[general] 
pass4SymmKey = <passphrase string> 
* Authenticates traffic between: 
* License master and its license slaves. 
* Members of a cluster; see Note 1 below. 
* Deployment server (DS) and its deployment clients (DCs); see Note 2 below. 
* Note 1: Clustering may override the passphrase specified here, in 
the [clustering] stanza. A clustering searchhead connecting to multiple masters 
may further override in the [clustermaster:stanza1] stanza. 
* Note 2: By default, DS-DCs passphrase auth is disabled. To enable DS-DCs passphrase auth, you must *also* add the 
following line to the [broker:broker] stanza in restmap.conf: 
requireAuthentication = true 
* In all scenarios, *every* node involved must 
set the same passphrase in the same stanza(s) (i.e. [general] and/or [clustering]); 
otherwise, respective communication (licensing and deployment in case of [general] stanza, 
clustering in case of [clustering] stanza) will not proceed. 

I put back the pass4symkey in clear and restarted splunk to encrypt it, then retried.

View solution in original post

yannK
Splunk Employee
Splunk Employee

It was a pass4symmkey difference between 2 servers of the same deployment.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Serverconf

see in $SPLUNK_HOME/etc/system/local/server.conf

[general] 
pass4SymmKey = <passphrase string> 
* Authenticates traffic between: 
* License master and its license slaves. 
* Members of a cluster; see Note 1 below. 
* Deployment server (DS) and its deployment clients (DCs); see Note 2 below. 
* Note 1: Clustering may override the passphrase specified here, in 
the [clustering] stanza. A clustering searchhead connecting to multiple masters 
may further override in the [clustermaster:stanza1] stanza. 
* Note 2: By default, DS-DCs passphrase auth is disabled. To enable DS-DCs passphrase auth, you must *also* add the 
following line to the [broker:broker] stanza in restmap.conf: 
requireAuthentication = true 
* In all scenarios, *every* node involved must 
set the same passphrase in the same stanza(s) (i.e. [general] and/or [clustering]); 
otherwise, respective communication (licensing and deployment in case of [general] stanza, 
clustering in case of [clustering] stanza) will not proceed. 

I put back the pass4symkey in clear and restarted splunk to encrypt it, then retried.

thambisetty_bal
Path Finder

Hi,

I changed the pass4SymmKey. I am still getting same error.

please let me know how to resolve this issue

0 Karma

olivier_ma
Explorer

It seems like I've the same error and I lost the pass4symm key.

Do you have any workaround ?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...