topic Re: Automatic linux/nix-TA installation on indexer in All Apps and Add-ons

Automatic linux/nix-TA installation on indexer

tfechner — Sat, 06 Jun 2020 01:01:48 GMT

Hi,

At startup of our indexer beeing part of a cluster there is an error stating that we have 2 *nix-TA installed. One in /etc/apps and one in etc/slave-apps.
As we are using only the clustermaster to deploy apps the first place etc/apps is wrong and not used by our setup.
I deleted this app and after a restart the app is again there.
I did not install splunk with some special command line options.

So why is Splunk installing an app in the wrong possition and where is the configuration?

Re: Automatic linux/nix-TA installation on indexer

vinod94 — Wed, 06 May 2020 09:12:51 GMT

Hi dyude, @tfechner ,

Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.

I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.

Re: Automatic linux/nix-TA installation on indexer

tfechner — Wed, 06 May 2020 09:19:49 GMT

mh.. it's not this way:
I never installed the app in /etc/app. I always use the cluster-master.

I remove the wrong app, restart the peer and then the app is again in /etc/apps!
No deployment-client used.

Re: Automatic linux/nix-TA installation on indexer

vinod94 — Wed, 06 May 2020 09:42:40 GMT

This link might help you..

https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/Updatepeerconfigurations#Settings_that_you_should_not_distribute_through_the_configuration_bundle

Re: Automatic linux/nix-TA installation on indexer

tfechner — Wed, 06 May 2020 10:01:33 GMT

oh - nice to see.
But it is the offical splunk audit linux-TA "TA-linux_audit".
We will search if there is any file which is created by the SHC or similar

Re: Automatic linux/nix-TA installation on indexer

vinod94 — Thu, 07 May 2020 04:54:21 GMT

Can you try moving the app which basically resides in cluster master to some other directory and then push the bundle(which basically will push the app without TA-nix) and see if the app is still in etc/apps on the slaves.

Re: Automatic linux/nix-TA installation on indexer

tfechner — Thu, 07 May 2020 15:44:11 GMT

ok - removed on CM this app - deployed bundle.
then updates to the recent version, and re-deploy.
works now.

Re: Automatic linux/nix-TA installation on indexer

vinod94 — Sat, 09 May 2020 08:40:01 GMT

Glad to know that it worked.