Deployment Architecture

Anyone else seeing clients not restarting after a deployment server push?

imacdonald2
Path Finder

I have a very simple example

[serverClass:ash-etl]
whitelist.0=server1

[serverClass:ash-etl:app:etl]
stateOnClient=enabled
restartSplunkd=True

[serverClass:ash-etl:app:fwd_to_splunk]
stateOnClient=enabled
restartSplunkd=True

When I change the verison in the app

[ui]
is_visible = 0
label = etl

[launcher]
author=Ian
description=Etl
version=1.5

The client downloads it but I get a ton of errors in the logs

01-09-2012 17:38:27.834 -0500 INFO  DeployedApplication - Downloaded url: 10.20.2.28:8089/services/streams/deployment?name=default:ash-etl:etl to file: /opt/splunk/var/run/ash-etl/etl-1326148643.bundle
01-09-2012 17:38:27.835 -0500 WARN  DeployedApplication - Installing app: etl to location: /opt/splunk/etc/apps/etl
01-09-2012 17:38:27.839 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.839 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.858 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.858 -0500 ERROR ConfObjectManagerDB - Cannot load to modify: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.858 -0500 ERROR DeployedApplication - Failed to install app : /opt/splunk/etc/apps/etl. Cannot update application info: /nobody/etl/app/install/state = enabled: Metadata could not be written: /nobody/etl/app/install/state: {  }, removable: yes
01-09-2012 17:38:27.858 -0500 WARN  DeployedServerClass - There was a problem installing app: etl for server class: ash-etl
01-09-2012 17:38:27.861 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.861 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.924 -0500 WARN  DeployedApplication - Installing app: etl to location: /opt/splunk/etc/apps/etl
01-09-2012 17:38:27.929 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.929 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.948 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.948 -0500 ERROR ConfObjectManagerDB - Cannot load to modify: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.948 -0500 ERROR DeployedApplication - Failed to install app : /opt/splunk/etc/apps/etl. Cannot update application info: /nobody/etl/app/install/state = enabled: Metadata could not be written: /nobody/etl/app/install/state: {  }, removable: yes
01-09-2012 17:38:27.948 -0500 WARN  DeployedServerClass - There was a problem installing app: etl for server class: ash-etl
01-09-2012 17:38:27.951 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.951 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta

I never see splunk reloading even though it has restartSplunkd=True, and the directory has been updated and has the new app version in the app.conf

I am running a fairly new version of the splunk 4.2

1 Solution

yannK
Splunk Employee
Splunk Employee

Known Bug on Splunk 4.2.4/4.2.5
see http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues#Distributed_deployment.2...

Under certain circumstances when deploying apps in 4.2.4, the deployment client will return the following error message: Cannot update application info: /nobody/appname/app/install/state = enabled: Metadata could not be written: /nobody/appname/app/install/state: { }, removable: yes. The workaround is to create a file and folder /metadata/local.meta in the installation tree of the app that the deployment server is deploying. (SPL-45019)

[edit]

to clarify the workaround :

if the problem is occurring with the app : myapp
on the deployment server on linux, do

mkdir $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/
touch $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/local.meta

it will create an empty local.meta file

then reload the deployment server
$SPLUNK_HOME/bin/splunk reload deploy-server

View solution in original post

yannK
Splunk Employee
Splunk Employee

Known Bug on Splunk 4.2.4/4.2.5
see http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues#Distributed_deployment.2...

Under certain circumstances when deploying apps in 4.2.4, the deployment client will return the following error message: Cannot update application info: /nobody/appname/app/install/state = enabled: Metadata could not be written: /nobody/appname/app/install/state: { }, removable: yes. The workaround is to create a file and folder /metadata/local.meta in the installation tree of the app that the deployment server is deploying. (SPL-45019)

[edit]

to clarify the workaround :

if the problem is occurring with the app : myapp
on the deployment server on linux, do

mkdir $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/
touch $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/local.meta

it will create an empty local.meta file

then reload the deployment server
$SPLUNK_HOME/bin/splunk reload deploy-server

imacdonald2
Path Finder

I have been banging my head against the wall over this all day.

0 Karma

pavanae
Builder

I seen the same issue occurred in splunk 6.1.3.. and i did the same as you mentioned..But still i am unable to see any difference..I am still not able to see the logs..

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...