Hi. I've been struggling with this for a more days than I'd care to admit. I'm HOPING someone can advise... (EnableBegging=True 🙂
GOAL: Install Universal Forwarder on Windows as a Deployment Client, via the CLI ("msiexec.exe /i ..."), such that deploymentclient.conf is NOT in "etc\system\local".
WHY: With deploymentclient.conf in "etc\system\local", it is impossible for the Deployment Server to change or override that configuration, in the event that, at some later date, we want to change the Deployment Server. In that scenario, we would have to touch every Deployment Client manually.
RESULTS FROM TESTING: If I include the DEPLOYMENT_SERVER flag in the CLI msiexec command, a deploymentclient.conf file is created, and placed in "etc\system\local". This actually "works", in that the DeploymentClient finds the Deployment Server, gets its config files, and begins eating log files and forwarding them to the Indexers - just like clockwork!. But, as explained above, it has the undesirable effect of placing deploymentclient.conf in a place where no DS-deployed apps can override it.
Conversely, if I OMIT the DEPLOYMENT_SERVER flag from the CLI msiexec command, NO deploymentclient.conf file is created in "etc\system\local" -- or anywhere else, for that matter. So far, so good (I thought!).
So, I next manually place deploymentclient.conf where I want it (in an "apps" directory), where it could be overridden at some later date. The problem is: I CAN'T GET THE DEPLOYMENT CLIENT TO FIND AND/OR USE deploymentclient.conf. I have done a "splunk restart", and I have Started the SplunkForwarder service (many, many times), but the Deployment Client never tries to contact the Deployment Server (packet captures confirm that it never sends a single packet to the DS).
It seems that, once the Universal Forwarder is installed WITHOUT the DEPLOYMENT_SERVER flag, it will never learn how to contact the Deployment Server, and will never become a Deployment Client.
As further indication of this last statement, I tried one other test. I installed the Universal Forwarder, WITHOUT the DEPLOYMENTSERVER flag, and then I placed deploymentclient.conf in "etc\system\local". STILL, after issuing splunkd restarts, and restarting the service, the Universal Forwarder does not try to contact the Deployment Server, even though deploymentclient.conf is in the very place where it lands when things "work" (when I do use the DEPLOYMENT_SERVER flag).
And... One final, additional piece of evidence... When I install WITHOUT the DEPLOYMENTSERVER flag, splunkd.log contains the below message, that may be the key to explaining this behavior:
WARN DeploymentClient - Property targetUri not found. DeploymentClient is disabled.
So, it seems that, if no Deployment Server is defined at install time, then Deployment Client functionality is disabled.
So... Either what I'm trying to do is not possible, OR... I need to learn how to "enable" DeploymentClient after the install.
Thanx for listening - I know it took a while! I will entertain all suggestions, questions or explanations.
mfeeny1
... View more