Deployment Architecture

Should a deployment server delete an application?

Path Finder

The following documentation is from the URL http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Updateconfigurations guide:

For example, say you are using the deployment server to manage updates to "appA". To do this, you have created a directory called "appA" in the repositoryLocation on the deployment server and you have placed the app's contents there. From now on, whenever the deployment clients poll the server to check for updates, they compare their checksum for appA with the server's checksum for appA. If the checksums differ, the clients download the latest version of the app from the server. However, if appA has been deleted from the server's app repository, the client behavior is to delete their own instances of the app.

I have a scenario where this isn't occurring. On installation of a new UF, I install 6 applications as follows:

TA-nix-fwd-np
TA-nix-fwd-p
VA-occ-all-fwd
VA-oce-all-fwd
VA-oce-all-fwd-nonprod
VA-ocs-all-fwd

The UF installation changes the installation state to enabled in app.conf in the local directory for 2 apps. For example one use case would enable apps VA-oce-all-fwd-nonprod & TA-nix-fwd-np. All of the UF installed apps are managed by the deployment server. The UF installation of apps includes a "base" set, since it was taking hours for a deployment server to deploy an application. This would impact the deployment metrics for a newly built VM.

In short, the apps managed by the deployment server are note being removed from the UF client. I would expect the deployment server to remove the following apps:

TA-nix-fwd-p
VA-occ-all-fwd
VA-oce-all-fwd
VA-ocs-all-fwd

Does anyone have any ideas?

Tags (3)
0 Karma

Splunk Employee
Splunk Employee

The deployment server will only tell the client to remove apps that it had previously deployed to them.

Say the deployment server (DS) distributes apps to universal forwarders (UF) A, B, C, and D to machines FOO and BAR.
The DS distributes apps A and B to UF BAZ.
BAZ has C and D installed manually

If DS is configured to quit distributing app A to all machines, then app A should be removed from FOO, BAR, and BAZ.
If the DS is configured to quit distributing app D to all machines, it should be removed from FOO and BAR. It will not be removed from BAZ because BAZ never received it from the DS.

Path Finder

The deployment server is at Splunk 5.0.4, and agents are at 5.0.5.

0 Karma

Community Manager
Community Manager

Hi @lisaac

What version of Splunk are you using?

0 Karma