Getting Data In

Forwarder keeps monitoring after app undeployed

Builder

Hi,

I'm just setting up a deployment server and created a simple app to test it. The app was installed fine on my universal forwarder. Undeploying the app also seemed to work fine.
Basically, I deleted the directory from etc/deployment-apps and did a 'splunk reload deploy-server' on the deployment server. The forwarder's log shows it indeed picked up the instruction and the directory is removed from the forwarder.

However, the forwarder keeps sending the information to the indexer and 'splunk list monitor' still shows the monitored file.

The forwarder's log also contains tens of lines like this:

10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/default.meta
10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/local.meta

Is this normal behaviour?

0 Karma
1 Solution

Motivator

On your deployment server's serverclass.conf, do you have restartSplunkd=True? If so, is it at the global level or in the app stanza? It sounds like it's updating the app properly but not restarting splunkd.

View solution in original post

Motivator

On your deployment server's serverclass.conf, do you have restartSplunkd=True? If so, is it at the global level or in the app stanza? It sounds like it's updating the app properly but not restarting splunkd.

View solution in original post

Builder

Actually, I've done some further testing on this and come to the conclusion that the forwarder will never restart after removing the app from deployment-apps. This is regardless of where I put the restartSplund=true. In the app stanza, the global level or serverclass stanza.

0 Karma

Builder

mikelanghorst,

It wasn't set at all, so that was the issue. Ie. the forwarders weren't restarting.

0 Karma

Motivator

Echalex, was that setting set at the global level, or at all?

0 Karma

Builder

mikelanghorst,

Thanks! That is apparently the issue. Restarting the forwarder fixed the issue and now I know why.

0 Karma