- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: Should a deployment server delete an applicati...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Should a deployment server delete an application?
The following documentation is from the URL http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Updateconfigurations guide:
For example, say you are using the deployment server to manage updates to "appA". To do this, you have created a directory called "appA" in the repositoryLocation on the deployment server and you have placed the app's contents there. From now on, whenever the deployment clients poll the server to check for updates, they compare their checksum for appA with the server's checksum for appA. If the checksums differ, the clients download the latest version of the app from the server. However, if appA has been deleted from the server's app repository, the client behavior is to delete their own instances of the app.
I have a scenario where this isn't occurring. On installation of a new UF, I install 6 applications as follows:
TA-nix-fwd-np
TA-nix-fwd-p
VA-occ-all-fwd
VA-oce-all-fwd
VA-oce-all-fwd-nonprod
VA-ocs-all-fwd
The UF installation changes the installation state to enabled in app.conf in the local directory for 2 apps. For example one use case would enable apps VA-oce-all-fwd-nonprod & TA-nix-fwd-np. All of the UF installed apps are managed by the deployment server. The UF installation of apps includes a "base" set, since it was taking hours for a deployment server to deploy an application. This would impact the deployment metrics for a newly built VM.
In short, the apps managed by the deployment server are note being removed from the UF client. I would expect the deployment server to remove the following apps:
TA-nix-fwd-p
VA-occ-all-fwd
VA-oce-all-fwd
VA-ocs-all-fwd
Does anyone have any ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The deployment server will only tell the client to remove apps that it had previously deployed to them.
Say the deployment server (DS) distributes apps to universal forwarders (UF) A, B, C, and D to machines FOO and BAR.
The DS distributes apps A and B to UF BAZ.
BAZ has C and D installed manually
If DS is configured to quit distributing app A to all machines, then app A should be removed from FOO, BAR, and BAZ.
If the DS is configured to quit distributing app D to all machines, it should be removed from FOO and BAR. It will not be removed from BAZ because BAZ never received it from the DS.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, is this still the case in V9? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The deployment server is at Splunk 5.0.4, and agents are at 5.0.5.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @lisaac
What version of Splunk are you using?
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
