After specifying an SslKeysfile value in server.conf, the Deployment Server Forwarder Management interface is very slow to return the number of clients connected. I have over 1000 forwarders that usually report to this server, and without these configs, the list is fully fledged after only about a minute or so. I've waited several minutes after securing splunkd, but the list is very very slow to populate.
This actually came up because I've been running "SslKeysFile" (which is a typo), and I'm assuming that splunkd was never secured up until this point, when I started removing the deprecated SSL keys in SSLConfig (caCertFile, caPath, etc.)
My previous config (with the typo, fast forwarder list generation):
[sslConfig]
allowSslCompression = false
caCertFile = cacert.crt
caPath = $SPLUNK_HOME/etc/auth/mycerts
enableSplunkdSSL = True
requireClientCert = false
sslKeysFile = server.pem
sslVersions = *,-ssl2,-ssl3
sslPassword =
My new config (slow list generation):
[sslConfig]
allowSslCompression = false
caCertFile = cacert.crt
caPath = $SPLUNK_HOME/etc/auth/mycerts
enableSplunkdSSL = True
requireClientCert = false
sslKeysfile = server.pem
sslVersions = *,-ssl2,-ssl3
sslPassword =
And finally, with the new key values (kvstore because I'm also running SPLUNK_FIPS) (slow list generation):
[sslConfig]
serverCert = $SPLUNK_HOME/etc/auth/mycerts/server.pem
sslRootCAPath = $SPLUNK_HOME/etc/auth/mycerts/cacert.crt
sslPassword =
allowSslCompression = false
enableSplunkdSSL = true
requireClientCert = false
[kvstore]
serverCert = $SPLUNK_HOME/etc/auth/mycerts/server.pem
sslPassword =
All configurations except the first one result in a very slow return of deployment clients in the GUI. Has anyone seen this before? Any ideas on what to look for? Splunkd.log doesn't show anything that really stands out. This is really all that pops up (web_service.log):
2016-12-09 16:56:32,325 INFO [584b52b93cb924f1f470] root:650 - CONFIG: error_page.default (instancemethod): >
2016-12-09 16:55:19,733 ERROR [584b503c1cefa7801470] root:129 - ENGINE: Handler for console events already off.
↧