deployment server weirdness

[nwieseler]

Hi All,

Environment: Small Splunk deployment. Two sites, a search head/indexer at each site (log01 and log02). One site handles the app deployment. Both sites are currently at 4.3.4, build 136012 - both are Windows 2008R2 servers.

Goal: I want to deploy two updated packages/apps to one of the indexers (the one that is not running the deployment server.

Information: Here is a snip of my serverclass.conf for the server I want to update - the apps are Splunk_CiscoSecuritySuite and Splunk_CiscoFirewalls.

#HQ Splunk Servers

[serverClass:dcm_hq_search]

whitelist.0 = log02

[serverClass:dcm_hq_search:app:Splunk_CiscoSecuritySuite]

[serverClass:dcm_hq_search:app:MAXMIND]

[serverClass:dcm_hq_search:app:Splunk_CiscoFirewalls]

In order to deploy the new apps, I completely deleted both Cisco apps (nevermind the MAXMIND app at the moment as I'm not upgrading it) from my deployment server i.e. neither of them are in /etc/deployment-apps but the apps will not go away on the server (log02) - I would expect them to.

If I try and force the issue by deleting the two apps, they will come back. Where they come from, I have no idea but they come back and they are the old versions (even if I have the new versions in /etc/deployment-apps on log01 which is the deployment server.

If I go into the UI under Manager > Deployment > Deployment Client I see this: log01:8089 and then all of the entries in serverclass.conf.

But if I go to /etc/system/local on log02, I don't see deploymentclient.conf like the docs say should be there.

Hopefully the above made sense. Just want to know why those two apps keep popping back up and where they're coming from because it certinaly doesn't seem like they're coming from the deployment server like they're supposed to be.

Thanks for any insight. I'm guessing I'm missing something really fundamental.

Nick

[nwieseler]

The fix to this was literally making a change to the serverclass.conf file. I changed the comment from HQ Splunk Servers to APPS DEPLOYED TO LOG02 HQ and it just started working.

Nice.

Nick

[nwieseler]

And of course doing a splunk reload deploy-server (which I promise didn't fix it until I made a change in the serverclass.conf file)

Nick

[rmorlen]

Did you try running from the CLI "splunk reload deploy-server -class dcm_hq_search". That will tell the deployment server to redeploy that class from serverclass.conf.

[nwieseler]

Hi there,

I just tried that and no change. On the dcm2 server (server that is defined in dcm_hq_search), I deleted the two apps/directories and both apps came back, perfectly un-updated.

Unfortunately, I had tried this troubleshooting step, not on this particular issue, but with something similar with no joy either. After reading the docs a little closer a reload of the entire deploy-server or reloading a specific class from the conf file is more for when one has changed the config.

I'll update this thread when I do get it resolved.

Thanks!

Nick