Security
Highlighted

Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

New Member

Hello. I have a set of 3 or so search-heads that have matching configurations. I am trying to configure an Apache Reverse-Proxy to load-balance between these servers to maximize search capacity and to handle HTTPS encoding, etc.

I have sucessfully setup the proxy to point to a single search head, but when I configure more than one, I find the sessions continuing to round-robin between servers, intead of "sticking" to on search head after a session is established. I have followed a few recommendations as documented on the Apache mod_proxy and mod_proxy_balancer docs, but so far can't make this work.

Does splunk have any standardized session variables, like "JSESSIONID" or the like I could leverage? Any other suggestions? Has anyone gotten this to work?

Thanks! Damon

Tags (3)
0 Karma
Highlighted

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

Splunk Employee
Splunk Employee

Haven't tried it myself, but looking at my splunk instance, it looks like there is a session_id_HTTPPORTNUMBER (e.g., session_id_8000) cookie. Will that do the trick?

Highlighted

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

Splunk Employee
Splunk Employee

That's correct. The port number is the listen port of the Splunk Web process, 8000 by default.

0 Karma
Highlighted

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

New Member

Hmmm. I tried adding that session cookie to the apache config, but can't seem to make that work- I am continually redirected back to the Splunk login screen when more than one backend proxies are configured. I'm assuming this is a session issue, because proxying a single backend server works fine, its when I add two or more that the behavior starts... I suppose this is more an Apache issue than Splunk, but I thought someone must have tried this.

Here is my Apache config snippet (more or less straight out of the Apache docs):

0 Karma
Highlighted

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

New Member


ProxyPass / balancer://mycluster/ stickysession=sessionid8000 nofailover=On timeout=15

ProxyPassReverse / balancer://mycluster/ stickysession=sessionid8000


BalancerMember http://10.x.x.10:8000
BalancerMember http://10.x.x.11:8000

0 Karma
Highlighted

Re: Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

New Member

Finally got this working using Apache's internal balancer cookies (ROUTEID) as described in http://httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html#example

0 Karma