Does pkgrm stop a splunk forwarder in a clean way on Solaris?

[chris]

Hi

To update our splunk forwarders we use puppet. Puppet first removes the splunk package and then installs the new package.

Is splunk stopped in a clean way when a pkgrm command is issued on Solaris?

We haven't had any trouble so far, we're just not sure if this always works

Thanks,

Chris

[pde · Accepted solution]

preremove executes this:

if [ -x $SPLUNK_HOME/bin/splunk ] ; then
    echo "Attempting to stop splunk."
    $SPLUNK_HOME/bin/splunk stop
fi

So you should be fine unless you've rolled your own SMF service, as I have. In that case, you'll need to tell puppet to disable the service before it removes the package, so the SMF doesn't attempt to restart splunk while it's being removed/reinstalled.

[pde]

I assume that your puppet manifest already knows when it's going to update splunk. If that's so, then just add

service { splunk: ensure =>'stopped', }

before you fetch your distribution file and do the pkgrm/pkgadd. One would think (though YMMV, I don't actually do this myself) that you could define a splunk package and have the splunk service subscribe to it, forcing a restart when the package is updated.

[chris]

Thanks, we do have our own SMF service but it is not setup to restart splunk automatically. So we should be ok. Or do you have an elegant way to detect, that you have to update splunk, so we could do an svcadm disable just before puppet upgrades the package?