Deployment Architecture

Anyone else seeing clients not restarting after a deployment server push?

imacdonald2
Path Finder

I have a very simple example

[serverClass:ash-etl]
whitelist.0=server1

[serverClass:ash-etl:app:etl]
stateOnClient=enabled
restartSplunkd=True

[serverClass:ash-etl:app:fwd_to_splunk]
stateOnClient=enabled
restartSplunkd=True

When I change the verison in the app

[ui]
is_visible = 0
label = etl

[launcher]
author=Ian
description=Etl
version=1.5

The client downloads it but I get a ton of errors in the logs

01-09-2012 17:38:27.834 -0500 INFO  DeployedApplication - Downloaded url: 10.20.2.28:8089/services/streams/deployment?name=default:ash-etl:etl to file: /opt/splunk/var/run/ash-etl/etl-1326148643.bundle
01-09-2012 17:38:27.835 -0500 WARN  DeployedApplication - Installing app: etl to location: /opt/splunk/etc/apps/etl
01-09-2012 17:38:27.839 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.839 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.858 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.858 -0500 ERROR ConfObjectManagerDB - Cannot load to modify: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.858 -0500 ERROR DeployedApplication - Failed to install app : /opt/splunk/etc/apps/etl. Cannot update application info: /nobody/etl/app/install/state = enabled: Metadata could not be written: /nobody/etl/app/install/state: {  }, removable: yes
01-09-2012 17:38:27.858 -0500 WARN  DeployedServerClass - There was a problem installing app: etl for server class: ash-etl
01-09-2012 17:38:27.861 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.861 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.924 -0500 WARN  DeployedApplication - Installing app: etl to location: /opt/splunk/etc/apps/etl
01-09-2012 17:38:27.929 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.929 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.948 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.948 -0500 ERROR ConfObjectManagerDB - Cannot load to modify: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.948 -0500 ERROR DeployedApplication - Failed to install app : /opt/splunk/etc/apps/etl. Cannot update application info: /nobody/etl/app/install/state = enabled: Metadata could not be written: /nobody/etl/app/install/state: {  }, removable: yes
01-09-2012 17:38:27.948 -0500 WARN  DeployedServerClass - There was a problem installing app: etl for server class: ash-etl
01-09-2012 17:38:27.951 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.951 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta

I never see splunk reloading even though it has restartSplunkd=True, and the directory has been updated and has the new app version in the app.conf

I am running a fairly new version of the splunk 4.2

1 Solution

yannK
Splunk Employee
Splunk Employee

Known Bug on Splunk 4.2.4/4.2.5
see http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues#Distributed_deployment.2...

Under certain circumstances when deploying apps in 4.2.4, the deployment client will return the following error message: Cannot update application info: /nobody/appname/app/install/state = enabled: Metadata could not be written: /nobody/appname/app/install/state: { }, removable: yes. The workaround is to create a file and folder /metadata/local.meta in the installation tree of the app that the deployment server is deploying. (SPL-45019)

[edit]

to clarify the workaround :

if the problem is occurring with the app : myapp
on the deployment server on linux, do

mkdir $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/
touch $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/local.meta

it will create an empty local.meta file

then reload the deployment server
$SPLUNK_HOME/bin/splunk reload deploy-server

View solution in original post

yannK
Splunk Employee
Splunk Employee

Known Bug on Splunk 4.2.4/4.2.5
see http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues#Distributed_deployment.2...

Under certain circumstances when deploying apps in 4.2.4, the deployment client will return the following error message: Cannot update application info: /nobody/appname/app/install/state = enabled: Metadata could not be written: /nobody/appname/app/install/state: { }, removable: yes. The workaround is to create a file and folder /metadata/local.meta in the installation tree of the app that the deployment server is deploying. (SPL-45019)

[edit]

to clarify the workaround :

if the problem is occurring with the app : myapp
on the deployment server on linux, do

mkdir $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/
touch $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/local.meta

it will create an empty local.meta file

then reload the deployment server
$SPLUNK_HOME/bin/splunk reload deploy-server

imacdonald2
Path Finder

I have been banging my head against the wall over this all day.

0 Karma

pavanae
Builder

I seen the same issue occurred in splunk 6.1.3.. and i did the same as you mentioned..But still i am unable to see any difference..I am still not able to see the logs..

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...