we are experiencing problem with the Deployment Server after the 7.2.3 release. The Universal Forwarder is installed with enable-boot start, so integrated in systemd.
After the deploy of a serverclass, with the "restart after deploy" flag checked, the forwarder stops communicating with the DS. We suppose this is because of the needs of a root password for restarting the splunk systemd service.
Does anyone have this problem? How can we manage it?
Summary of the issue:
Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start
Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start
Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start
systemd defaults to prompting for root credentials upon stop/start/restart of Splunk
Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd.
Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as):