How to create a serverclass.conf file to control the configuration of the Exchange App deployment

Question

I'm looking for a sample a serverclass.conf file, to help me create one for my Exchange 2007 and 2010 Environment. I'm stuck on the Deploying configurations for all server section in the Splunk App for Microsoft Exchange Deploy...

Answer 1

I've only done it for Exchange 2007. It may also not be the best way to do things, but this is the way I did it (note that our CAS and HUB servers are one and the same):

[global]

[serverClass:Exchange-2007-ForeFront:app:fwd_exchange2007_forefront]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-CasHub:app:fwd_exchange2007_cas]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-CasHub:app:fwd_exchange2007_hub]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-Store:app:fwd_exchange2007_store]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-Reputation:app:fwd_reputation]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-Windows-2008R2:app:fwd_win2008r2_iis]
stateOnClient = enabled
restartSplunkd = true

[serverClass:Exchange-2007-CasHub]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*

[serverClass:Exchange-2007-Store]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchmb0*

[serverClass:Exchange-Reputation]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub01

[serverClass:Exchange-Windows-2008R2]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*
whitelist.1 = pwexchmb0*

[serverClass:Exchange-2007-ForeFront]
blacklist.0 = *
filterType = blacklist
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = pwexchhub0*

Answer 2

To resume, in your serverclass.conf :

Create 3 server classes: "Exchange Client Access", "Exchange Hub Transport" and "Exchange Mailbox Store"
Put the appropriate hosts in each class. It is ok if the host appears in multiple classes.

Deploy the apps as follow

fwd_exchange20XX_cas and fwd_win2003_iis to the CAS/client Access servers, 
fwd_exchange20XX_hub and fwd_exchange20XX_forefront to the Hub transports
fwd_exchange20XX_store to the mailbox Store.
the additional apps to deploy is fwd_reputation that can be on any server with internet access.

Answer 3

Here is an example of the serverclass.conf with the 3 groups CAS-HUB-STORE

# CAS classes
[serverClass:Exchange07CAS]
whitelist.0=cas01.domain.com
whitelist.1=cas02.domain.com
whitelist.2=cas03.domain.com
[serverClass:Exchange07CAS:apps:fwd_exchange2007_cas]

[serverClass:ExchangeWin2K3CAS]
whitelist.0=cas01.domain.com
[serverClass:ExchangeWin2K3CAS:apps:fwd_win2003_iis]

[serverClass:ExchangeWin2K8CAS]
whitelist.0=cas02.domain.com
whitelist.1=cas03.domain.com
[serverClass:ExchangeWin2K8CAS:apps:fwd_win2008r2_iis]

# HUB classes
[serverClass:Exchange07HUB]
whitelist.0=hub01.domain.com
whitelist.1=hub02.domain.com
[serverClass:Exchange07HUB:apps:fwd_exchange2007_hub]
[serverClass:Exchange07HUB:apps:fwd_exchange2007_forefront]

# Store classes
[serverClass:Exchange07STORE]
whitelist.0=store01.domain.com
whitelist.1=store02a.domain.com
whitelist.2=store02b.domain.com
[serverClass:Exchange07STORE:apps:fwd_exchange2007_store]

# Reputation classes
[serverClass:ExchangeREP]
whitelist.0=extweb.domain.com
[serverClass:ExchangeREP:apps:fwd_reputation]

How to create a serverclass.conf file to control the configuration of the Exchange App deployment

Follow this question

Splunk Resources

Related questions