splunk reload deploy-server not updating bundles

[Lucas_K]

According to splunk official deployment server documentation (5.0.2) if you do change to a serverclass.conf you need a full restart BUT if you only update a file within an deployed app then its a "splunk reload deploy-server" (no class flag specified so it should check EVERYTHING).

When you first configure the deployment server, and whenever you update its configuration by editing serverclass.conf, you'll need to restart or reload it for the changes to take effect. The clients will then pick up any new or changed content. Instead of restarting the server, you can use the CLI reload deploy-server command. - source : http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Updateconfigurations

I am however finding that updating of an app (edit of an existing and addition of an entirely new file) and issuing the reload command doesn't actually refresh/update the tar bundles within the $SPLUNK_HOME/var/run/tmp dir. The bundles still have the same time stamps and also epoch times in their file names.

I'm 100% sure this works fine in v4 as we utilise a cron scheduled reload deploy-server command to auto refresh our apps when they are updated.

I've tried running the reload command with "-debug" but it doesn't really give much insight into what is actually occuring.

Note: Yes I know a full splunk restart will create the bundles with the updated changes. Yes I realise this is a work around but I don't want to be bouncing splunk every 10 mins to replicate app changes around. It's feeling like a bug or something I have totally missed in the v4->v5 change.

[Lucas_K · Accepted solution]

I've we've found that its is not documented that if you are using a tenanted environment that you need to modify your reload command so that it works. This is not documented in the tenantsconf ( http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Tenantsconf - no mention of a reload command change at all!)

This does not work - ./splunk reload deploy-server

I would have expected that it reloads ALL deployment classes for everything the deployment server can see. This is not the case it only reloads the default serverclass and nothing more. Hence why a full splunk restart was the only way to fix it.

TL:DR,

The fix. Specify your tenants in the reload command.

Works - ./splunk reload deploy-server -tenant dept1
...
./splunk reload deploy-server -tenant deptx and so on.

Each and EVERY tenant must be individually specified.

[Lucas_K]

Further update to this. Seems to currently be a bug with deployment server in which a reload deploy-server results in clients saying they are unable to contact deployment server 😞

As such the only way to push out changes is to do a full restart on the deployment server.

[Lucas_K]

ticket logged 😕

[mjones414]

I'm also experiencing this same issue with 5.0.2 with known working server classes in 4.3.x