View configurations installed on your forwarders

You can quickly view the configuration installed on your forwarders, without the need to log in to the forwarders, or run btool, by using the Effective Configuration add-on.

Overview

The Effective Configuration add-on saves time and eliminates the need to contact other teams, helping you access the information you need in seconds instead of days.

btool is a command-line tool used in Splunk Enterprise to simulate the merging of configuration files and report on the merged settings. For more information about btool, see Use btool to troubleshoot configurations.

Note: btool shows the configuration saved on disk and not the one in memory.

Using the Effective Configuration add-on also allows you to view the actual configuration used on agents, including all parameter changes. You can view the current effective configuration on selected agents and check parameter values set in the following files:

  • inputs.conf
  • outputs.conf
  • deploymentclient.conf
  • server.conf

To view the effective configuration that is currently used on the forwarders, complete the following tasks:

  1. Meet all prerequisites.
  2. Install the Effective Configuration add-on.
  3. (Optional) Reduce the size of the Effective Configuration add-on.
  4. Verify that the Effective Configuration add-on is installed.

Security

The connection is initiated from the agent side, using the same management port for communication. Requests are authenticated with the pass4SymmKey and can be further secured using TLS settings. The Effective Configuration add-on reuses the same TLS settings as the forwarder, considering all settings specified under the [sslConfig] stanza in the server.conf file.

The minimum supported SSL version for communication between the agent and the agent management is TLS 1.0.

Limitations

If you're managing a large number of agents, avoid installing the Effective Configuration add-on on all agents at the same time. To reduce load, set maxConcurrentDownloads = 17 in the serverclass.conf file. This slightly slows down the process of installation and sending out the Effective Configuration add-on, but the configuration is delivered shortly after the add-on is installed on the agent. This value is based on the results from add-on tests.

The scalability setup of agent management

To use the agent management in a clustered environment with the scalability feature introduced in version 9.2, it is essential to configure a shared drive for var/lib/effective-configuration. This setup is similar to the configuration of other shared directories. For more information, see Implement a deployment server cluster.

Cleanup process

Currently, there is no strict limit on the storage of effective configurations files on disc. However, a pre-established soft limit manages storage effectively. When this limit is exceeded, the system automatically removes outdated effective configurations to free up space. An outdated effective configuration means that an agent hasn't sent a single phonehome for more than 10 times its average phonehome interval.

For example, if the average phonehome interval of an agent is 1 minute, the storage limit is exceeded and if no phonehome is sent for 10 minutes, the effective configuration for that agent is removed.

The following setting is used in the agent_management.conf file:

CODE 
[effective_configuration]
max_size = 16
cleanup_threshold = 6144
cleanup_schedule = 0 3 * * *

By default, the cleanup process is scheduled to run daily at 3 AM local server time. It runs only if the total size of saved effective configurations exceeds 6,144 MB. Additionally, it removes effective configurations only for agents that have been inactive for a significant period of time.

Note: In the cluster mode, only 1 agent management can have a configured cleanup process.

To turn off the cleanup process, set cleanup_schedule = disabled .

The following calculations outline the total effective configuration size that you can use to set the cleanup threshold based on the fleet size:

  • Minimum required disk storage: 125 MB for every 1,000 agents
  • Recommended disk storage: 250 MB for every 1,000 agents