Forwarder keeps monitoring after app undeployed

[echalex]

Hi,

I'm just setting up a deployment server and created a simple app to test it. The app was installed fine on my universal forwarder. Undeploying the app also seemed to work fine.
Basically, I deleted the directory from etc/deployment-apps and did a 'splunk reload deploy-server' on the deployment server. The forwarder's log shows it indeed picked up the instruction and the directory is removed from the forwarder.

However, the forwarder keeps sending the information to the indexer and 'splunk list monitor' still shows the monitored file.

The forwarder's log also contains tens of lines like this:

10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/default.meta
10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/local.meta

Is this normal behaviour?

[mikelanghorst · Accepted solution]

On your deployment server's serverclass.conf, do you have restartSplunkd=True? If so, is it at the global level or in the app stanza? It sounds like it's updating the app properly but not restarting splunkd.

[echalex]

Actually, I've done some further testing on this and come to the conclusion that the forwarder will never restart after removing the app from deployment-apps. This is regardless of where I put the restartSplund=true. In the app stanza, the global level or serverclass stanza.

[echalex]

mikelanghorst,

It wasn't set at all, so that was the issue. Ie. the forwarders weren't restarting.

[mikelanghorst]

Echalex, was that setting set at the global level, or at all?

[echalex]

mikelanghorst,

Thanks! That is apparently the issue. Restarting the forwarder fixed the issue and now I know why.