Deployment Architecture

Why is my Deployment Server showing an error pushing apps apps to the Cluster Master/SHC Deployer?

chawagon03
Path Finder

We have a clustered environment and I have the Cluster Master also being the SH Deployer. I'm trying to simplify the process of getting apps to this server by using the deployment server to push apps to it.

My deployment server serverclass.conf currently looks like:

[serverClass:CM_master-apps]
targetRepositoryLocation = $SPLUNK_HOME/etc/master-apps
stateOnClient = noop
whitelist.0 = dev.splunk.cm

[serverClass:CM_master-apps:app:CM_indexes]
restartSplunkWeb = 0
restartSplunkd = 0
stateOnClient = enabled

This works great and it pushes the app to the etc/master-apps directory like I want, BUT now the deployment server is showing a deployment error. Is this because of some sort of checksum or something as the deployment server holds the app in etc/deployment-apps and its going to the client to etc/master-apps?

PLEASE HELP 🙂

0 Karma

woodcock
Esteemed Legend

There is a bug in serverclass.spec that causes Splunk Deployment Server to give the following FALSE error logs:

Checking conf files for problems...
                Invalid key in stanza [serverClass:site1_indexers] in /opt/splunk/etc/system/local/serverclass.conf, line XXX: targetRepositoryLocation  (value:  $SPLUNK_HOME/etc/master-apps).
                Invalid key in stanza [serverClass:site1_indexers] in /opt/splunk/etc/system/local/serverclass.conf, line XXX+1: targetRepositoryLocationPolicy  (value:  rejectAlways).

You can confirm that it actually works by running /opt/splunk/bin/splunk show config serverclass | grep targetRepository which will give you this (which clearly indicates functional configurations):

targetRepositoryLocation=$SPLUNK_HOME/etc/apps
targetRepositoryLocation=$SPLUNK_HOME/etc/master-apps
targetRepositoryLocationPolicy=rejectAlways

You can double-check that it should work by running /opt/splunk/bin/splunk btool serverclass list --debug| grep targetRepository which will give you this (which clearly indicates valid configurations):

/opt/splunk/etc/system/default/serverclass.conf targetRepositoryLocation = $SPLUNK_HOME/etc/apps
/opt/splunk/etc/system/local/serverclass.conf   targetRepositoryLocation = $SPLUNK_HOME/etc/master-apps
/opt/splunk/etc/system/local/serverclass.conf   targetRepositoryLocationPolicy = rejectAlways

You can also confirm by checking the target Cluster Master destination which will clearly show that it does indeed pull in CM apps to $SPLUNK_HOME/etc/apps/ as well as Indexer apps (via a different serverclass using the targetRepository* settings) to $SPLUNK_HOME/etc/master-apps/.

It is unfortunate the both the documentation and the spec files are in error. I am open a documentation updated request to get this mess cleared up.

NOTE: You may, or may not, desire the rejectAlways setting. Use it or don't; it has nothing to do with the viability of the other setting(s).

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi chawagon03,

I just fixed the same error by using the stateOnClient = noop in serverclass.conf. I had to add it because I was daisy chaining deployment servers.

cheers, MuS

0 Karma

chawagon03
Path Finder
10-14-2015 03:20:16.967 +0000 WARN  ClientSessionsManager - ip=10.0.23.20 name=2F8C8052-0C05-4478-8DEF-D11D40EFF709 Updating record for sc=CM_master-apps app=CM_indexes: action=Install result=Fail checksum=3035554467044237313

10-14-2015 03:20:16.967 +0000 INFO  ClientSessionsManager - ip=10.0.23.20 name=2F8C8052-0C05-4478-8DEF-D11D40EFF709 Updating record for sc=CM_master-apps app=CM_indexes: action=Download result=Ok checksum=3035554467044237313

10-14-2015 03:20:16.967 +0000 INFO  ClientSessionsManager:Listener_AppEvents - Received count=2 AppEvents from DC ip=10.0.23.20 name=2F8C8052-0C05-4478-8DEF-D11D40EFF709

10-14-2015 03:20:16.870 +0000 INFO  PackageDownloadRestHandler - peer=10.0.23.20:37480 Download complete for path=/opt/splunk/var/run/tmp/CM_master-apps/CM_indexes-1444792555.bundle serverclass=CM_master-apps app=CM_indexes

10-14-2015 03:20:16.870 +0000 INFO  PackageDownloadRestHandler - peer=10.0.23.20:37480 Download started for path=/opt/splunk/var/run/tmp/CM_master-apps/CM_indexes-1444792555.bundle serverclass=CM_master-apps app=CM_indexes
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This is not a recommended or supported configuration. There can be issues with this.

However, if you look at the stateonclient configuration option, you can get around these errors with the 'noop' function and a custom repository path to the CM's master-apps.

stateOnClient = enabled | disabled | noop
* If set to "enabled", sets the application state to enabled on the client, regardless of state on the deployment server.
* If set to "disabled", set the application state to disabled on the client, regardless of state on the deployment server.
* If set to "noop", the state on the client will be the same as on the deployment server.
* Can be overridden at the serverClass level and the serverClass:app level.
* Defaults to enabled.

chawagon03
Path Finder

Here is what I currently have going on on deployment client and deployment server. I can't seem to get the stateOnClient = noop to do anything (maybe I don't fully understand what it does)

################################################
### Deployment Client (Master Node/Deployer)
### deploymentclient.conf
################################################
[deployment-client]
serverRepositoryLocationPolicy = rejectAlways
repositoryLocation = $SPLUNK_HOME/etc/deployed-apps

[target-broker:deploymentServer]
targetUri = dev.splunk.deploy:8089

################################################
### Deployment Server
### serverclass.conf
################################################
[serverClass:CM_master-apps]
stateOnClient = noop
whitelist.0 = dev.splunk.cm

[serverClass:CM_master-apps:app:CM_indexes]
restartSplunkWeb = 0
restartSplunkd = 0
stateOnClient = enabled

I also changed it to go to a generic directory and just create soft links in the appropriate directory whether its an indexer app or SH app

0 Karma

shaun_dyble
Explorer

Hi,

Were you able to resolve this issue? Im having the same problem.

Cheers

Shaun

0 Karma

chawagon03
Path Finder

I did not find the 'approved' solution to this. But I did find a work around that works for me at the moment.

If you set stateOnClient = noop on the app level stanza, the deployment server shows no issues. I also set targetRepositoryLocation on the server class level stanza and created 2 server classes for master-apps directory and shcluster/apps directory.

This isn't the approved way - but it works for me without having to tar > ftp > untar from wherever to cluster master.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What error is being shown on the Deployment server?

0 Karma

chawagon03
Path Finder
10-13-2015 23:33:09.440 +0000 WARN  ClientSessionsManager - ip=10.0.23.20 name=2F8C8052-0C05-4478-8DEF-D11D40EFF709 Updating record for sc=CM_master-apps app=CM_indexes: action=Install result=Fail checksum=3035554467044237313

This is what is in splunkd.log for deployment serverr.. i take it it is a checksum issue.. Anyway to get around this? Because the apps gets pushed like it should, I just don't want to have that error consistent in our production environment.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...