Installation

Is there a proper step by step process to bring up a new license master when one goes down?

sonicZ
Contributor

I did not see a definitive answer for this yet, But i have Two datacenters managed by single license server. Maintenance window will cause disconnection from one remote datacenter to the license master.

I tested creating a new license master in the datacenter that is to be disconnected during the maintenance window,

  • built new license master, removed lab indexer from current production license master
  • copied over licenses, server.conf(pool info) from current master to new master.
  • editing lab indexer server.conf to point to new master, bounced lab indexer.

immediately started seeing duplicate license errors on the testlab SH.
Is there a step by step proper process to bring up a new master when one goes down?
(not create pools in server.conf etc)

Labels (1)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi sonicZ,

like @linu1988 wrote, it used to be 24 hours before you get into trouble if your license master is gone.

In Splunk 6.1.3, if the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues).

Nevertheless here is the doc about How to swap the license master

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi sonicZ,

like @linu1988 wrote, it used to be 24 hours before you get into trouble if your license master is gone.

In Splunk 6.1.3, if the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues).

Nevertheless here is the doc about How to swap the license master

cheers, MuS

View solution in original post

linu1988
Champion

I am quite sure that indexer/ search heads at least needs to have a communication every 24 hours. There should not be any issue if there is a temporary disconnection.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!