Installation

pass4SymmKey error when setting Master License

guimilare
Communicator

Hello Splunkers.

I have an Indexer Clusters with 2 members (IDX1 and IDX2).
We need to add another 2 indexers to the cluster.
The Indexer Cluster is in version 6.5.0.
The are 2 other machines (they will be IDX3 and IDX4) running the same splunk version, but their Trial License expired a long time ago and were never added to Indexer Cluster or set as Slave License servers.

I've changed the license on IDX3 and IDX4 to Free License and restarted splunkd.
But when trying to configure IDX3 and IDX4 to be slaves of a Master License, I get the following message:

Bad Request - editTracker failed, reason=WARN: path=/masterlm/usage: Signature mismatch between license slave=XX.XXX.XXX.XXX and this License Master. Please make sure that the pass4SymmKey setting in server.conf, under [general], is the same for the License Master and all its slaves from ip=XX.XXX.XXX.XXX

I've copied the pass4SymmKey from Master License to IDX3 and IDX4 but no luck.
Any ideas what I can do?
Or should I reinstall Splunk on these machines?

Regards,
GMA

0 Karma
1 Solution

masonmorales
Influencer

The pass4SymmKey is encrypted using splunk.secret, so you're likely copying an encrypted pass4SymmKey to hosts with different splunk.secret files.

Do you know what the plain text pass4SymmKey was set to on the License Master (LM)? If not, you can just set a new pass4SymmKey on the LM in plain text, restart it, (it'll encrypt automatically after restart), and use the same plain text pass4SymmKey/restart process on the other LM slaves.

View solution in original post

masonmorales
Influencer

The pass4SymmKey is encrypted using splunk.secret, so you're likely copying an encrypted pass4SymmKey to hosts with different splunk.secret files.

Do you know what the plain text pass4SymmKey was set to on the License Master (LM)? If not, you can just set a new pass4SymmKey on the LM in plain text, restart it, (it'll encrypt automatically after restart), and use the same plain text pass4SymmKey/restart process on the other LM slaves.

DUThibault
Contributor

YoungN
Splunk Employee
Splunk Employee

Can I clarify that you typed in the pass4SymmKey and not copied from the Master? As the Master will encrypt the password after initial setup and you would not be able to just copy it over.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...