Hi.
QUESTION: is there a method/configuration to fully align a UF with the Deployment Server?
Let me explain:
DS
ServerX has 3 addons configured, addon#1 + addon#2 + addon#3
UF on ServerX
Receives perfectly addon#1 + addon#2 + addon#3
Now, a user enter root in ServerX and create his own custom addon inside UF, addon#4. Now ServerX has addon#1 + addon#2 + addon#3 (DS) + addon#4 (custom created by user)
Is there a way to tell DS: maintain ONLY addon#1 + addon#2 + addon#3 and DELETE ALL OTHER CUSTOM ADDONS (addon#4 in this example)?
Thanks.
It doesn't work that way.
1. DS doesn't manage anything. The DC (deployment client - typically a forwarder, but you can use DS to configure other components) calls the DS and asks for curremt versions of the apps that DS thinks the DC should have.
2. The DC compares the checksum for each app it got from the DS with a checksum of the app it has locally. If it differs, the DC removes local app and unpacks the app downloaded from the DS. (Or removes an app if the app is explicitly configured to be removed as far as I remember but I'm not 100% sure here)
And that's pretty much there is to it. So there is no way to manage apps which are not explicitly configured. But even if you tried doing so with ugly hacks like spawning a script from an input which would scan all aps on a DC and remove all but whitelisted ones, remember that there are default apps in etc/apps which are installed during the component installation and upgraded with it. And you don't want to mess with them.
So:
1) No
EDIT: Interesting, I'm pretty sure I've typed in more than just that "no" above. But apparently only this made it to the answer. I have no idea what happened.
It doesn't work that way.
1. DS doesn't manage anything. The DC (deployment client - typically a forwarder, but you can use DS to configure other components) calls the DS and asks for curremt versions of the apps that DS thinks the DC should have.
2. The DC compares the checksum for each app it got from the DS with a checksum of the app it has locally. If it differs, the DC removes local app and unpacks the app downloaded from the DS. (Or removes an app if the app is explicitly configured to be removed as far as I remember but I'm not 100% sure here)
And that's pretty much there is to it. So there is no way to manage apps which are not explicitly configured. But even if you tried doing so with ugly hacks like spawning a script from an input which would scan all aps on a DC and remove all but whitelisted ones, remember that there are default apps in etc/apps which are installed during the component installation and upgraded with it. And you don't want to mess with them.
So:
1) No
EDIT: Interesting, I'm pretty sure I've typed in more than just that "no" above. But apparently only this made it to the answer. I have no idea what happened.
Thanks, i know how DS<>UF works 😉
So,
Is there a way to tell DS: maintain ONLY addon#1 + addon#2 + addon#3 and DELETE ALL OTHER CUSTOM ADDONS (addon#4 in this example)?
THE ANSWER IS: NO!!! 😁
👍👍👍
Hi @verbal_666 ,
if a user (also root) directy adds an apps (or add-on) on a UF managed by a Depoyment Server, at the first check on UF configurations by the DS, the not managed app is removed by the UF.
Ciao.
Giuseppe
Giuseppe,
aren't you confused with the Deployer SH? 🤔
Because the Deployer behaves as you said 👍
Thanks & bye.
Hi @verbal_666 ,
As I said I had a situation where apps installed on a Deployment Client (a UF) where removed because they weren't in the related ServerClass on the DS.
Ciao.
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉
Very strange, since also PickleRick says it's the normal behaviour of a DS not deleting custom addons 🤔
It's not so 😣
On a 8.2.x Infra, users addons on a UF, controlled by DS, remains on UF.
I also check on another TEST INFRASTRUCTURE, and custom addons remains inside /etc/apps of UF, controlled by DS.
UF did handshake on DS.
/etc/apps of UF
+++my addons deployed by DS
Check_System
Ethernet-Speed
GET_ALL
maxKBps
output
+++custom addons created on UF (still there)
GET_ALL_FAKE_IDX
LOCAL
+++internal
SplunkUniversalForwarder
introspection_generator_addon
journald_input
learned
search
splunk_httpinput
splunk_internal_metrics
INFO DC:HandshakeReplyHandler [1815 HttpClientPollingThread_A48B7A13-D8C3-4DBB-ADAD-5F1F80E30A12] - Handshake done.
I say, i prefer this behaviour, since sometimes it's useful to insert addons manually, outside DS, but i wanted to know if it was possible, in fact, the opposite, with changes to the DS!
I confirm custom addons remains on my UFs 🤕
Hi @verbal_666,
it's really strange, because I experienced the opposite behavior: the DS removed all the apps non managed by itself but I don't remember the version.
Anyway, open a case To Splunk Support.
Ciao.
Giuseppe
Maybe some DS conf to change?
I'll see. For now, as said, i prefer to maintain custom users addons 😊 in fact, I would have problems with several users 😁
Only wanted to know if there was a way to do the opposite 😎
Thanks 👍