uberAgent

Installing the Windows Endpoint Agent

The agent installer is available as an MSI package. The MSI can either be installed manually or unattended through existing software deployment tools or Splunk’s Deployment Server.

Note

Securing the Configuration Directory

uberAgent can be configured via the %ProgramData% directory (details). It is important to secure this directory, or standard users might be able to elevate their privileges to SYSTEM and/or abuse uberAgent.

Starting with version 7.0.2, uberAgent’s installer secures the agent’s %ProgramData% directories automatically. Two new MSI parameters provide control over the process: PROGRAMDATA_CONFIGDIR_RESETPERMISSIONS and PROGRAMDATA_CONFIGDIR_DELETEFILES (see below).

We recommend disabling those MSI parameters only if you’re managing the security of %ProgramData%\vast limits and its subdirectories via other means. We recommend the following permissions:

Administrators: full control SYSTEM: full control

Optionally provide read access to standard users on scripts that are to be executed in user context:

Users: read

Note

Changed Startup Behavior After Installation

Starting with uberAgent 7.2.1, the uberAgent installer does not start the service automatically after a successful installation. Please update any agent deployment procedures to reflect changes.

Manual Installation

Run the batch file uberAgent_endpoint\bin\manual-install.cmd.

Configuration

uberAgent can be configured very flexibly. By editing the configuration you can switch metrics on or off, change the data collection frequency and significantly reduce the data volume.

Note

Template Configuration Files Available on GitHub

Starting with uberAgent 7.3.1, the agent installer does not store the template configuration files on disk any more. You can download the latest template config files for your installed uberAgent version on GitHub.

Configuration Directory Change - Windows

Starting with uberAgent 7.3.0, the agent no longer searches for configuration files in the installation directory. To configure uberAgent, download the template configuration files from GitHub (see above), make your changes, deploy the configuration files to: %PROGRAMDATA%\vast limits\uberAgent\Configuration, and start the uberAgent service. For more details, please see: Configuration via Local Config Files.

License File

If you have a license file for uberAgent, copy it to the installation directory (default: %ProgramFiles%\vast limits\uberAgent). Without a license file, uberAgent displays a splash screen during logon.

Installation Through a Software Deployment Tool

Install the appropriate MSI file from the directory uberAgent_endpoint\bin depending on the bitness of your machine: uberAgent-32.msi or uberAgent-64.msi.

MSI Parameters

Specify the following MSI parameters:

INSTALLDIR

Required: no
Description: installation directory
Valid values: any local file system path

PROGRAMDATA_CONFIGDIR_RESETPERMISSIONS

Required: no
Default: 1
Description: Set secure permissions on uberAgent’s ProgramData directory (%ProgramData%\vast limits\uberAgent).
Valid values:
- 0: disabled
- 1: enabled

PROGRAMDATA_CONFIGDIR_DELETEFILES

Required: no
Default: 1
Description: Delete existing config files in uberAgent’s ProgramData directory (%ProgramData%\vast limits\uberAgent). Disable this setting only if you’re removing potentially malicious existing config files as part of your own deployment package logic.
Valid values:
- 0: disabled
- 1: enabled

License File

Installation Through Splunk Deployment Server

Note: Deployment Server can only be used with Splunk Enterprise and requires Splunk Universal Forwarder on the endpoint as deployment client.

uberAgent

Copy the directory uberAgent_endpoint from the unzipped uberAgent download package to $SPLUNK_HOME\etc\deployment-apps on your deployment server.

Note: $SPLUNK_HOME refers to the base directory of the Splunk installation, typically %ProgramFiles%\Splunk.

Configuration

To deploy a customized configuration file, copy it into the directory $SPLUNK_HOME\etc\deployment-apps\uberAgent_endpoint\bin. This overwrites the default configuration file from the installation package.

License File

If you have a license file for uberAgent, copy it into the directory $SPLUNK_HOME\etc\deployment-apps\uberAgent_endpoint\bin.

Serverclass

Create a file called serverclass.conf in $SPLUNK_HOME\etc\system\local on your deployment server. Serverclass.conf defines what to deploy where. For a quick start paste the following content into Serverclass.conf to deploy uberAgent to all Windows machines. You may want to fine-tune this to suit your needs.

# [global]
# We cannot match by machine type here. We'll do that on the app level below.
whitelist.0 = *

# Define a serverclass
[serverClass:windows]
# Deploy only to Windows machines
machineTypesFilter = windows-*

# Define which apps to deploy to the serverclass
[serverClass:windows:app:uberAgent_endpoint]
stateOnClient = enabled
restartSplunkd = true
<!--NeedCopy-->

To make Splunk read the new file serverclass.conf, run the following command:

$SPLUNK_HOME\splunk.exe reload deploy-server
<!--NeedCopy-->

Citrix Site Monitoring

If some or all of your endpoints are running the Citrix Virtual Apps and Desktops (CVAD) VDA, you should install uberAgent on the Citrix delivery controller(s), too. Please see this page for details.

Endpoint to Backend Communication Via Splunk Universal Forwarder

Note: This is optional and not required for the recommended architecture.

If you decided to implement the alternative endpoint to backend communication path via Splunk Universal Forwarder, you need to install Universal Forwarder on each endpoint.

Imaging & Citrix PVS

If you intend to copy the agent installation via an imaging method or Citrix PVS, we recommend you remove instance-specific information. To do that, follow these steps right before capturing the image:

Stop the service uberAgent (but leave the start type at automatic).
Open an administrative command prompt.
Run the command: reg delete "HKLM\SOFTWARE\vast limits\uberAgent" /f /reg:64.
Optionally: delete existing log files.
Optionally: delete existing Persistent Output Queue files/folders.
Prepare the machine for cloning as necessary, but do not reboot.

If you have Splunk Universal Forwarder installed, please follow the steps listed here, too.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Installing the Windows Endpoint Agent

Installing the Windows Endpoint Agent

Manual Installation

Configuration

License File

Installation Through a Software Deployment Tool

MSI Parameters

INSTALLDIR

PROGRAMDATA_CONFIGDIR_RESETPERMISSIONS

PROGRAMDATA_CONFIGDIR_DELETEFILES

License File

Installation Through Splunk Deployment Server

uberAgent

Configuration

License File

Serverclass

Imaging & Citrix PVS

In this article