All Servers are - windows 2008 R2 on virtualized hardware. All Splunk components running - Splunk: 5.0.3
It appears that when you remove a well defined App (contains both the local.meta and app.conf), there is a chance that the deployment client will not restart.
Steps:
- Modify the serverclass.conf on the deployment server so that the app in question will no longer be pushed to a forwarder
- reload the deployment server -
bin>splunk reload deploy-server
The app is always deleted on the forwarder, but the forwarder sometimes doesn't restart.
It appears that there was an issue that if you don't have the app.conf or the local.meta files, your deployment client may not restart post update of the app. Is this a special case? Has anyone seen this behavior before?
In these logs, I am removing the win_infra_fwdr app by changing the serverclass.conf.
06-24-2013 11:29:46.169 -0400 WARN DeployedApplication - Uninstalling application: win_infra_fwdr
06-24-2013 11:29:46.169 -0400 WARN DeployedApplication - Removing app at location: C:\Program Files\SplunkUniversalForwarder\etc\appswin_infra_fwdr
06-24-2013 11:29:46.174 -0400 WARN DeployedApplication - setting restart flag in context
06-24-2013 11:29:46.229 -0400 ERROR ConfObjectManagerDB - Cannot initialize: C:Program FilesSplunkUniversalForwarder\etc\apps\win_infra_fwdr\metadata\local.meta: The system cannot find the path specified.
06-24-2013 11:29:46.245 -0400 WARN ConfPathMapper - Failed to open: C:\Program Files\SplunkUniversalForwarder\etc\apps\win_infra_fwdr\local\app.conf: The system cannot find the path specified.
06-24-2013 11:29:46.245 -0400 WARN DeploymentClient - Restarting Splunkd...
06-24-2013 11:29:46.937 -0400 INFO loader - Shutdown HTTPDispatchThread
06-24-2013 11:29:46.937 -0400 INFO ShutdownHandler - Shutting down splunkd