Getting Data In
Highlighted

Forwarder keeps monitoring after app undeployed

Builder

Hi,

I'm just setting up a deployment server and created a simple app to test it. The app was installed fine on my universal forwarder. Undeploying the app also seemed to work fine.
Basically, I deleted the directory from etc/deployment-apps and did a 'splunk reload deploy-server' on the deployment server. The forwarder's log shows it indeed picked up the instruction and the directory is removed from the forwarder.

However, the forwarder keeps sending the information to the indexer and 'splunk list monitor' still shows the monitored file.

The forwarder's log also contains tens of lines like this:

10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/default.meta
10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/local.meta

Is this normal behaviour?

0 Karma
Highlighted

Re: Forwarder keeps monitoring after app undeployed

Motivator

On your deployment server's serverclass.conf, do you have restartSplunkd=True? If so, is it at the global level or in the app stanza? It sounds like it's updating the app properly but not restarting splunkd.

View solution in original post

Highlighted

Re: Forwarder keeps monitoring after app undeployed

Builder

mikelanghorst,

Thanks! That is apparently the issue. Restarting the forwarder fixed the issue and now I know why.

0 Karma
Highlighted

Re: Forwarder keeps monitoring after app undeployed

Motivator

Echalex, was that setting set at the global level, or at all?

0 Karma
Highlighted

Re: Forwarder keeps monitoring after app undeployed

Builder

mikelanghorst,

It wasn't set at all, so that was the issue. Ie. the forwarders weren't restarting.

0 Karma
Highlighted

Re: Forwarder keeps monitoring after app undeployed

Builder

Actually, I've done some further testing on this and come to the conclusion that the forwarder will never restart after removing the app from deployment-apps. This is regardless of where I put the restartSplund=true. In the app stanza, the global level or serverclass stanza.

0 Karma