Installation

How to resolve frequent license issue errors such as "In handler 'localslave': editTracker failed" on Search Head Cluster?

sivapuvvada
Path Finder

We have Search Head cluster with 3 nodes. We try to point all these nodes to my License master .
When I tried to do as the master Uri from the SH members/Deployer UI it showing error message:

"Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=x.x.xx.xx " 

I have manually updated the same from CLI in server.conf, it worked but slaves are not contacting frequently license master . After 24 hrs i am getting license expired message on Splunk Web. Again, I have removed the master uri stanza and placed the same back and restarted. it worked

How to fix this one ?

Also I have done telnet from my search head members to license master and it connected without any issues.

Labels (3)
0 Karma
1 Solution

sivapuvvada
Path Finder

The root cause for the issue is pass4SymmKey present in server.conf

[general]
pass4SymmKey = test
serverName = x.x.x.x.x

When ever any server you tried to point to licensemaster , The LM pass4symmkey should be same as the server which you want to point .

this one implemented in prod environment and working fine without any issues .

View solution in original post

sivapuvvada
Path Finder

The root cause for the issue is pass4SymmKey present in server.conf

[general]
pass4SymmKey = test
serverName = x.x.x.x.x

When ever any server you tried to point to licensemaster , The LM pass4symmkey should be same as the server which you want to point .

this one implemented in prod environment and working fine without any issues .

hunters_splunk
Splunk Employee
Splunk Employee

Hi sivapuvvada,

Please try running the following CLI command on each slave:

splunk edit licenser-localslave -master_uri https://{Lic_Master:mgmt_port}

To check the list of license slaves, run this command on the license master:

splunk list licenser-slaves

Hope this helps. Thanks!
Hunter

0 Karma

sivapuvvada
Path Finder

Hi Hunter ,

I tried as you suggested but got the below error message .

In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=x.x.xx.xxx

0 Karma
Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...