I'm just setting up a deployment server and created a simple app to test it. The app was installed fine on my universal forwarder. Undeploying the app also seemed to work fine.
Basically, I deleted the directory from etc/deployment-apps and did a 'splunk reload deploy-server' on the deployment server. The forwarder's log shows it indeed picked up the instruction and the directory is removed from the forwarder.
However, the forwarder keeps sending the information to the indexer and 'splunk list monitor' still shows the monitored file.
The forwarder's log also contains tens of lines like this:
10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory 10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/default.meta 10-11-2011 14:41:54.735 +0300 ERROR IniFile - Cannot open ini file for parsing: No such file or directory 10-11-2011 14:41:54.735 +0300 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunkforwarder/etc/apps/Bar/metadata/local.meta
Is this normal behaviour?
On your deployment server's serverclass.conf, do you have restartSplunkd=True? If so, is it at the global level or in the app stanza? It sounds like it's updating the app properly but not restarting splunkd.
Thanks! That is apparently the issue. Restarting the forwarder fixed the issue and now I know why.
Actually, I've done some further testing on this and come to the conclusion that the forwarder will never restart after removing the app from deployment-apps. This is regardless of where I put the restartSplund=true. In the app stanza, the global level or serverclass stanza.