uberAgent - no data in Splunk when CCFM is used
Article ID: CTX695878
Updated On:
Description
uberAgentConfiguration.log located in C:\Windows\Temp folder shows a few lines only (system information).
uberAgent.log located in C:\Windows\Temp folder shows two issues:
- CopyConfigFilesToCache,Inconsistent CCFM metadata detected.
- ExtractRemoteBundleToLocalCache,Malformed config-bundle. uberAgent.conf not a top-level file.
Cause
The admin zipped entire folder to uAconfig file instead of adding the folder content only.
Resolution
Check the uberAgent.uAconfig bundle.
You can open archive using 7zip or rename the file extension to .zip and open in Windows Explorer.
If the bundle is incorrect - create a new uAConfig bundle and ensure that the config file is at the top level.
Example:
Issue/Introduction
uberAgent is not sending any data to Splunk.
CCFM is used and correct policy / registry key is in place pointing to the correct network share location.
uberAgent does not read config file from CCFM path.
Additional Information
Central Config File Management
https://docs.citrix.com/en-us/uberagent/7-4-x/installation/central-config-file-management.html
