The other day I came across universal forwarder based deployment client which was not receiving deployment server apps as expected.
When looking at the HttpPubSubConnection (PhoneHome) records in the splunkd log on the deployment client I noticed that the IP address posted to the deployment server was an IP address of one of the host's network interfaces which did not have a route to the deployment server. When I restarted the splunk agent, the next phone home happened to post the correct IPv4 address having a valid route to the deployment server, and of course the apps downloaded.
How does the deployment client decide which ipv4 address (of possibly multiple) to present when phoning home?
↧