topic Re: Forwarder Not Getting Updated Apps from Deployment Server in Deployment Architecture

Forwarder Not Getting Updated Apps from Deployment Server

bmpotter13 — Tue, 08 May 2018 20:13:52 GMT

I have an app bundle that packages both a Python script and inputs configuration. I have a couple of servers in a server class and am deploying my app to this class. The deployment server shows that the forwarders on each server have checked in within the last few seconds but the changes I make to my inputs.conf or my script in bin are never reflected on the server.

Will the deployment server recognize that a file has been altered in an app bundle and then push this to clients when they phone home? Or do I need to manually update existing servers while newly added servers will get the current app bundle?

Deployment server version: Splunk 6.5.1 (build f74036626f0c)

Versions of Forwarder:

Splunk Universal Forwarder 6.5.3 (build 36937ad027d4)
Splunk Universal Forwarder 6.6.1 (build aeae3fe0c5af)

All files in my app:

+---bin
|       README
|       my-script.py
|
+---default
|   |   app.conf
|   |
|   \---data
|       \---ui
|           +---nav
|           |       default.xml
|           |
|           \---views
|                   README
|
+---local
|       app.conf
|       inputs.conf
|       props.conf
|
\---metadata
        default.meta
        local.meta

serverclass.conf:

[serverClass:my_server_class:app:my_app]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

Re: Forwarder Not Getting Updated Apps from Deployment Server

somesoni2 — Tue, 08 May 2018 20:46:34 GMT

Did you restart Or reload the deployment server after making the change?
http://docs.splunk.com/Documentation/Splunk/7.1.0/Updating/Useserverclass.conf#Reload_the_deployment_server

Re: Forwarder Not Getting Updated Apps from Deployment Server

bmpotter13 — Tue, 08 May 2018 22:03:17 GMT

I wouldn't think it necessary to reload an entire application to identify a new version of an app is available.

Though not mentioned in that documentation, if I uninstall the app from the server class, wait, then reinstall it, then the changes are recognized.

How does this work?

Re: Forwarder Not Getting Updated Apps from Deployment Server

somesoni2 — Wed, 09 May 2018 00:05:48 GMT

If you make changes through UI, a reload is not required. If an was present and DS was reloaded, then you remove app without reloading again and put it again it still has the reference of the app and works fine. Basically when you reload or restart DS it creates checksum (can say inventory or listing) of apps, based on content and modification date. So if you change content of app you need to restart/reload DS to update the checksum.

Re: Forwarder Not Getting Updated Apps from Deployment Server

jkat54 — Wed, 09 May 2018 01:24:07 GMT

You need more serverclass.conf settings:

  [serverClass:my_server_class]
  whitelist.0=Regex

  [serverClass:my_server_class:app:my_app]
  restartSplunkWeb = 0
  restartSplunkd = 1
  stateOnClient = enabled

Change regex to be a regex that matches the hostname, guid, or IP of the splunk forwarders that need the apps. You can have more whitelists and also blacklists. See serverclass.conf for more details.