When upgrading from 6.4.0 to 6.5.0, why do I get error "rmdir: failed to remove `/opt/splunk': Device or resource busy"?

New Member

When upgrading from Splunk 6.4.0 to 6.5.0, I am getting below error:

$sudo rpm -U /tmp/splunk-6.5.0-59c8927def0f-linux-2.6-x86_64.rpm
warning: /tmp/splunk-6.5.0-59c8927def0f-linux-2.6-x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 653fb112: NOKEY
This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server...
splunkd is not running. [FAILED]
Remove *.pyc *.pyo in /opt/splunk
rmdir: failed to remove `/opt/splunk': Device or resource busy    

Not sure why /opt/splunk directory was being removed and if rpm upgrade is complete?

Labels (1)
0 Karma

Path Finder

Yes, I agree with jack. Could you please check with the file system permissions whether it is read-only or not.

Try to check with process id's. Somtimes the process id's will also cause problems. If this is the issue, please kill some of the unwanted processes and try to implement it again. You might able to get it done.

Make sure you restart after the migration is complete.

0 Karma


Sounds like something is holding the file open. Can you confirm the partition isn't read-only? Also, might do an lsof on those files.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...