Deployment Architecture
Highlighted

Splunk 7.2.3 Deployment Server Automatic splunkforwarder restart

New Member

Hi all,
we are experiencing problem with the Deployment Server after the 7.2.3 release. The Universal Forwarder is installed with enable-boot start, so integrated in systemd.
After the deploy of a serverclass, with the "restart after deploy" flag checked, the forwarder stops communicating with the DS. We suppose this is because of the needs of a root password for restarting the splunk systemd service.

Does anyone have this problem? How can we manage it?

Thank you in advance!

Davide Magni

0 Karma
Highlighted

Re: Splunk 7.2.3 Deployment Server Automatic splunkforwarder restart

Motivator

Summary of the issue:
Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start
Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start
Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start

systemd defaults to prompting for root credentials upon stop/start/restart of Splunk

Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd.

Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as):

sudo /opt/splunk/bin/splunk disable boot-start
sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0

Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as):

sudo /opt/splunkforwarder/bin/splunk disable boot-start
sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0
0 Karma