Hi
To update our splunk forwarders we use puppet. Puppet first removes the splunk package and then installs the new package.
Is splunk stopped in a clean way when a pkgrm command is issued on Solaris?
We haven't had any trouble so far, we're just not sure if this always works
Thanks,
Chris
preremove executes this:
if [ -x $SPLUNK_HOME/bin/splunk ] ; then
echo "Attempting to stop splunk."
$SPLUNK_HOME/bin/splunk stop
fi
So you should be fine unless you've rolled your own SMF service, as I have. In that case, you'll need to tell puppet to disable the service before it removes the package, so the SMF doesn't attempt to restart splunk while it's being removed/reinstalled.
preremove executes this:
if [ -x $SPLUNK_HOME/bin/splunk ] ; then
echo "Attempting to stop splunk."
$SPLUNK_HOME/bin/splunk stop
fi
So you should be fine unless you've rolled your own SMF service, as I have. In that case, you'll need to tell puppet to disable the service before it removes the package, so the SMF doesn't attempt to restart splunk while it's being removed/reinstalled.
I assume that your puppet manifest already knows when it's going to update splunk. If that's so, then just add
service { splunk: ensure =>'stopped', }
before you fetch your distribution file and do the pkgrm/pkgadd. One would think (though YMMV, I don't actually do this myself) that you could define a splunk package and have the splunk service subscribe to it, forcing a restart when the package is updated.
Thanks, we do have our own SMF service but it is not setup to restart splunk automatically. So we should be ok. Or do you have an elegant way to detect, that you have to update splunk, so we could do an svcadm disable just before puppet upgrades the package?