Is this entry in my splunkd.log file sketchy?

[ferdie]

But this is unusual. I found a new log entry that looks sketchy. But its in the splunkd.log file. What is it used for?

HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.1.1.34_8089_srftp.b.com_SRFTP_FAB4D96E-5A4A-4593-8914-635506217E40

[ogdin · Accepted solution]

As it relates to Splunk Light, this is a record that a Deployment Client, in this case a Universal Forwarder, has made contact with the Splunk Light instance and is asking if there are any new configuration updates. This happens on a regular interval (60s by default). This is the server-side record to the "set deploy-poll" command on the Forwarder. Splunk Light uses the Deployment Server/Deployment Client setup, same as Splunk Enterprise, as a part of the Add Data, data from Splunk forwarder section in the UI so that you can tell remote hosts with Splunk Forwarders installed to start sending data to your Splunk Light instance.

[jeffland]

Yeah, I was suprised to see an expression like "phone home" in the official logs too when I first saw it. But it's ok, it happens when you use a deployment server to distribute configuration files to client instances and the clients poll their server (which is called "phoning home"). If you have the feature enabled, you can go to "Settings" -> "Forwarder Management" to see the clients that successfully "phoned home".

[ferdie]

Agreed. I think the term itself caused a bit of alert. "Phone Home" is the term used with Command and Control traffic where the pwned bot calls back for the hackers instructions.

Maybe it would be better to use the term "Deployment server poll" or similar.

Thanks,
Ferdie

[stephane_cyrill]

Splunk - troubleshooting remote agents with the
phonehome logs

runals.blogspot.com/2014/02/splunk-troubleshooting-remote-agents.html?m=1

[piebob]

@ferdie i moved your question to a new question for clarity.