Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

[damonmiller]

Hello. I have a set of 3 or so search-heads that have matching configurations. I am trying to configure an Apache Reverse-Proxy to load-balance between these servers to maximize search capacity and to handle HTTPS encoding, etc.

I have sucessfully setup the proxy to point to a single search head, but when I configure more than one, I find the sessions continuing to round-robin between servers, intead of "sticking" to on search head after a session is established. I have followed a few recommendations as documented on the Apache mod_proxy and mod_proxy_balancer docs, but so far can't make this work.

Does splunk have any standardized session variables, like "JSESSIONID" or the like I could leverage? Any other suggestions? Has anyone gotten this to work?

Thanks! Damon

[damonmiller]

Finally got this working using Apache's internal balancer cookies (ROUTEID) as described in http://httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html#example

[David]

Haven't tried it myself, but looking at my splunk instance, it looks like there is a session_id_HTTPPORTNUMBER (e.g., session_id_8000) cookie. Will that do the trick?

[damonmiller]

ProxyPass / balancer://mycluster/ stickysession=session_id_8000 nofailover=On timeout=15

ProxyPassReverse / balancer://mycluster/ stickysession=session_id_8000

BalancerMember http://10.x.x.10:8000
BalancerMember http://10.x.x.11:8000

[damonmiller]

Hmmm. I tried adding that session cookie to the apache config, but can't seem to make that work- I am continually redirected back to the Splunk login screen when more than one backend proxies are configured. I'm assuming this is a session issue, because proxying a single backend server works fine, its when I add two or more that the behavior starts... I suppose this is more an Apache issue than Splunk, but I thought someone must have tried this.

Here is my Apache config snippet (more or less straight out of the Apache docs):

[gkanapathy]

That's correct. The port number is the listen port of the Splunk Web process, 8000 by default.