Failed to install app

[joonradley]

Hi,

After redeploying an app today I received the following errors and just cannot find the reason fro this:

11-21-2011 15:57:06.718 +0200 ERROR DeployedApplication - Failed to install app : C:\Program Files\Splunk\etc\apps\collectors_db2. Cannot update application info: /nobody/collectors_db2/app/install/state = enabled: Metadata could not be written: /nobody/collectors_db2/app/install/state: {  }, removable: yes

11-21-2011 15:57:07.405 +0200 ERROR ConfObjectManagerDB - Cannot initialize: C:\Program Files\Splunk\etc\apps\collectors_db2\metadata\local.meta

Using Splunk 4.2.4 on Windows 2008 R2 running as LocalSystem service account.

I have changed the permission on the folders, but the issue persist.

Can anyone point me in the right direction?

Thx

[virtualpony]

I'm using 4.3 deploy server and 4.3 universal forwarders when deploying an app, but the metadata directory and local.meta file does not get created. If I try to create the directory and file, it gets deleted.

I tried removing the entire app from the forwarding system and reloading the deploy server, but the same issue happens.

[virtualpony]

None of the other apps I deployed have the metadata dir on the deployment server and they work. In any case, I added the metadir/local.meta to the problematic app. It is still throwing issues:

2/24/12 9:16:43.122 AM

Cannot load to modify: C:\Program Files\SplunkUniversalForwarder\etc\apps\admon\metadata\local.meta

02-24-2012 09:16:43.122 -0800 ERROR ConfObjectManagerDB - Cannot load to modify: C:\Program Files\SplunkUniversalForwarder\etc\apps\admon\metadata\local.meta

4

2/24/12 9:16:43.122 AM

Cannot open ini file for parsing: The system cannot find the path specified.

[sdwilkerson]

virtualpony,
The metadata direcotry and the underlying local.meta must exists in a deployment-server environment in order for the app to be installed on the deployment client.

[tpaulsen]

Strange...we deploy from a 4.1.7 Deployment Server to a Splunk 4.3 Universal Forwarder and get the same error (under Linux SLES11).

The workaround described above did work here also.

[tpaulsen]

thank you. The strange part is, that it does not happen with every deployment. I am currently upgrading our Forwarder from 4.1 to 4.3. We´ll see if this happens more often.

[sdwilkerson]

tpaulsen,
My answer above still applies in 4.3. Splunk requires local.meta to exist in the app on the deployed system so it can write information locally; unfortunatley they didn't build in a routine to create the file if it didn't exist.
The work-around is still to create these files on the deployment server prior to deployment.

[jbsplunk]

This is documented in the 4.2.4 known issues with a workaround:

http://docs.splunk.com/Documentation/Splunk/latest/releasenotes/KnownIssues

Under certain circumstances when deploying apps in 4.2.4, you'll get an error on the deployment client that says: 'cannot update application info: /nobody/appname/app/install/state = enabled: Metadata could not be written: /nobody/appname/app/install/state: { }, removable: yes.' The workaround is to create a file and folder /metadata/local.meta in the app in the deployment-server.(SPL-45019) 

[jbsplunk]

It was fixed in 4.3.1

[halr9000]

The issue is no longer on the known issues list. I just emailed support to make sure that they are still tracking it in case this is a regression.

[sdwilkerson]

Good catch on the KnownIssues.

[wrangler2x]

That link takes you to the latest known issues. Here is one that goes to the 4.2.4 known issues:

http://docs.splunk.com/Documentation/Splunk/4.2.4/ReleaseNotes/KnownIssues

I've found that if you delete the deployment app directory on the forwarder out of $SPLUNK_HOME/etc/apps and restart splunkd the app will be re-installed and the problem goes away. This happened on one of my forwarders and that is what I did there. But when it happened on two other forwarders this week I went looking to see if it was a known issue and found this. I've placed the metadata/local.meta in all my apps on the deployment server because the folks that own these three systems don't want to do an upgrade to 6.1.4, which is what I'm installing on all new forwarders and when I do upgrades. The thing is, these forwarders have run a long time without this issue happening, and I wonder what triggered it on these three in a two week period. Odd.

[sdwilkerson · Accepted solution]

joonradley,

I have started seeing this error at several customer sites after upgrading them to Splunk-4.2.4. I never saw it prior to 4.2.4.
I believe this is a logic bug of some kind (it looks like a change which is inappropriately measuring for local.meta's existence).
The fix is going to be when Splunk puts out a patch.
In the meantime, you can create an empty local.meta file in your apps and the error goes away (in the cases where I have seen this).

I use a little for loop to implement this solution:

1. cd $SPLUNK_HOME/etc/apps (or $SPLUNK_HOME/etc/deployment-apps)
2. for i in ls -d; do [ ! -f $i/metadata/local.meta ] && touch $i/metadata/local.meta; done;

Reload and all is well.

I would love to hear someone from Splunk provide more details on this.

Best,
Sean

[joonradley]

thank you. worked perfectly