When upgrading from 6.4.0 to 6.5.0, why do I get error "rmdir: failed to remove `/opt/splunk': Device or resource busy"?

[suneelthammishe]

When upgrading from Splunk 6.4.0 to 6.5.0, I am getting below error:

$sudo rpm -U /tmp/splunk-6.5.0-59c8927def0f-linux-2.6-x86_64.rpm
warning: /tmp/splunk-6.5.0-59c8927def0f-linux-2.6-x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 653fb112: NOKEY
This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server...
splunkd is not running. [FAILED]
complete
Remove *.pyc *.pyo in /opt/splunk
rmdir: failed to remove `/opt/splunk': Device or resource busy    

Not sure why /opt/splunk directory was being removed and if rpm upgrade is complete?

[chskm]

Yes, I agree with jack. Could you please check with the file system permissions whether it is read-only or not.

Try to check with process id's. Somtimes the process id's will also cause problems. If this is the issue, please kill some of the unwanted processes and try to implement it again. You might able to get it done.

Make sure you restart after the migration is complete.

[jackhamm25]

Sounds like something is holding the file open. Can you confirm the partition isn't read-only? Also, might do an lsof on those files.