Hi everyone! This issue is exclusively for splunk universal forwarder v9.2.1 .. what’s happening here is the script is dumping yum updates check on satellite thereby filling all the space in the servers. When checked ingernal logs, it seems the update.sh is installing the older version of these satellite linux packages and then throwing message as
message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/update.sh" Not using downloaded (satellite package name like rhel..blah..blah) because it is older than what we have:
Have any one faced this particular issue? I am not able to understand why is the update.sh trying to install the older packages in the first place ... Can anyone suggest what can be done to resolve it? Thanks.
