Splunk Enterprise

Is this entry in my splunkd.log file sketchy?

ferdie
Explorer

But this is unusual. I found a new log entry that looks sketchy. But its in the splunkd.log file. What is it used for?

HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.1.1.34_8089_srftp.b.com_SRFTP_FAB4D96E-5A4A-4593-8914-635506217E40

Tags (1)
1 Solution

ogdin
Splunk Employee
Splunk Employee

As it relates to Splunk Light, this is a record that a Deployment Client, in this case a Universal Forwarder, has made contact with the Splunk Light instance and is asking if there are any new configuration updates. This happens on a regular interval (60s by default). This is the server-side record to the "set deploy-poll" command on the Forwarder. Splunk Light uses the Deployment Server/Deployment Client setup, same as Splunk Enterprise, as a part of the Add Data, data from Splunk forwarder section in the UI so that you can tell remote hosts with Splunk Forwarders installed to start sending data to your Splunk Light instance.

View solution in original post

ogdin
Splunk Employee
Splunk Employee

As it relates to Splunk Light, this is a record that a Deployment Client, in this case a Universal Forwarder, has made contact with the Splunk Light instance and is asking if there are any new configuration updates. This happens on a regular interval (60s by default). This is the server-side record to the "set deploy-poll" command on the Forwarder. Splunk Light uses the Deployment Server/Deployment Client setup, same as Splunk Enterprise, as a part of the Add Data, data from Splunk forwarder section in the UI so that you can tell remote hosts with Splunk Forwarders installed to start sending data to your Splunk Light instance.

View solution in original post

jeffland
Champion

Yeah, I was suprised to see an expression like "phone home" in the official logs too when I first saw it. But it's ok, it happens when you use a deployment server to distribute configuration files to client instances and the clients poll their server (which is called "phoning home"). If you have the feature enabled, you can go to "Settings" -> "Forwarder Management" to see the clients that successfully "phoned home".

ferdie
Explorer

Agreed. I think the term itself caused a bit of alert. "Phone Home" is the term used with Command and Control traffic where the pwned bot calls back for the hackers instructions.

Maybe it would be better to use the term "Deployment server poll" or similar.

Thanks,
Ferdie

0 Karma

stephane_cyrill
Builder

Splunk - troubleshooting remote agents with the
phonehome logs

runals.blogspot.com/2014/02/splunk-troubleshooting-remote-agents.html?m=1

0 Karma

piebob
Motivator

@ferdie i moved your question to a new question for clarity.

0 Karma