Change the phone home interval on every agent

Improve performance by increasing the phone home interval to reduce the frequency of agent check-ins.

Performance issues in agent management can cause slow responses from the deployment/server/clients endpoint. The following symptoms indicate a performance issue:
  • The response from the endpoint deployment/server/clients takes more than 30 seconds.
  • The Agent Management home page takes more than 30 seconds to load.
  • Searching by host name or app takes more than 30 seconds to complete.
  • The list of matched agents for server class takes more than 30 seconds to load.
  1. Evaluate the impact of changing the phone home interval.

    You can change the value of the phoneHomeIntervalInSecs setting in the $SPLUNK_HOME/etc/system/local/deploymentclient.conf file on an agent to affect how fast application changes are propagated to the agents. Application changes are sent to agents when a phone home is received.

    The phone home interval is the time interval, in seconds, at which an agent contacts agent management to check for configuration updates.

    Note: The configuration update is tied to the phone home interval. If you set a high phoneHomeIntervalInSecs value, the configuration change (such as an application change) takes up to that amount of time to apply.

    Higher phone home frequency can affect performance. Increasing the value of the phoneHomeIntervalInSecs setting helps to mitigate the issue.

  2. Calculate the phoneHomeIntervalInSecs value that you need.

    To calculate the phoneHomeIntervalInSecs value, use the following formula:

    NewPhoneHomeIntervalInSecs = ([previousPhoneHomeIntervalInSecs] * [frozenTimePeriodInSecs]) / ([hours] * 3600)

    Where:

    • [hours] is the number of hours during which the performance is still acceptable. For example, if the performance is acceptable for the first two days, [hours] = 48.
    • [previousPhoneHomeIntervalInSecs] is the phone home interval value that will be replaced. The assumption is that the phoneHomeIntervalInSecs value is the same across all agents. If that is not the case, use the average or mode for the calculations.
    • [frozenTimePeriodInSecs] is the value of the frozenTimePeriodInSecs setting under the [_dsphonehome] stanza in the $SPLUNK_HOME/etc/apps/SplunkDeploymentServerConfig/local/indexes.conf file (or if this file does not exist, the default value: 604800).

    The value calculated with this formula is the lowest phoneHomeIntervalInSecs value that provides performance that would be acceptable to you. You can use a higher value. The higher the value, the better the performance. For example, if the value calculated with the formula is 120 but you are satisfied with a 240-second phone home interval, you can use 240 instead.

    Note: If you changed the index retention period (see "Change the index retention period"), use the updated value of the index retention period to calculate the phoneHomeIntervalInSecs value.
  3. On an agent, in the $SPLUNK_HOME/etc/system/local/deploymentclient.conf file, change the value of the phoneHomeIntervalInSecs setting.

    The following is an example of a stanza with phoneHomeIntervalInSecs set to 300:

    [deployment-client]
    disabled = 0
    phoneHomeIntervalInSecs = 300
    Note: You must change this value on every agent in your environment.
  4. For maximum effectiveness, change the phoneHomeIntervalInSecs value on all agents.

    Each agent with an unchanged phoneHomeIntervalInSecs value contributes to performance degradation.

  5. Restart every modified agent using the splunk restart command.