Deployment Architecture

Anyone else seeing clients not restarting after a deployment server push?

imacdonald2
Path Finder

I have a very simple example

[serverClass:ash-etl]
whitelist.0=server1

[serverClass:ash-etl:app:etl]
stateOnClient=enabled
restartSplunkd=True

[serverClass:ash-etl:app:fwd_to_splunk]
stateOnClient=enabled
restartSplunkd=True

When I change the verison in the app

[ui]
is_visible = 0
label = etl

[launcher]
author=Ian
description=Etl
version=1.5

The client downloads it but I get a ton of errors in the logs

01-09-2012 17:38:27.834 -0500 INFO  DeployedApplication - Downloaded url: 10.20.2.28:8089/services/streams/deployment?name=default:ash-etl:etl to file: /opt/splunk/var/run/ash-etl/etl-1326148643.bundle
01-09-2012 17:38:27.835 -0500 WARN  DeployedApplication - Installing app: etl to location: /opt/splunk/etc/apps/etl
01-09-2012 17:38:27.839 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.839 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.858 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.858 -0500 ERROR ConfObjectManagerDB - Cannot load to modify: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.858 -0500 ERROR DeployedApplication - Failed to install app : /opt/splunk/etc/apps/etl. Cannot update application info: /nobody/etl/app/install/state = enabled: Metadata could not be written: /nobody/etl/app/install/state: {  }, removable: yes
01-09-2012 17:38:27.858 -0500 WARN  DeployedServerClass - There was a problem installing app: etl for server class: ash-etl
01-09-2012 17:38:27.861 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.861 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.924 -0500 WARN  DeployedApplication - Installing app: etl to location: /opt/splunk/etc/apps/etl
01-09-2012 17:38:27.929 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.929 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.948 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.948 -0500 ERROR ConfObjectManagerDB - Cannot load to modify: /opt/splunk/etc/apps/etl/metadata/local.meta
01-09-2012 17:38:27.948 -0500 ERROR DeployedApplication - Failed to install app : /opt/splunk/etc/apps/etl. Cannot update application info: /nobody/etl/app/install/state = enabled: Metadata could not be written: /nobody/etl/app/install/state: {  }, removable: yes
01-09-2012 17:38:27.948 -0500 WARN  DeployedServerClass - There was a problem installing app: etl for server class: ash-etl
01-09-2012 17:38:27.951 -0500 ERROR IniFile - Cannot open ini file for parsing: No such file or directory
01-09-2012 17:38:27.951 -0500 ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/etc/apps/etl/metadata/local.meta

I never see splunk reloading even though it has restartSplunkd=True, and the directory has been updated and has the new app version in the app.conf

I am running a fairly new version of the splunk 4.2

1 Solution

yannK
Splunk Employee
Splunk Employee

Known Bug on Splunk 4.2.4/4.2.5
see http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues#Distributed_deployment.2...

Under certain circumstances when deploying apps in 4.2.4, the deployment client will return the following error message: Cannot update application info: /nobody/appname/app/install/state = enabled: Metadata could not be written: /nobody/appname/app/install/state: { }, removable: yes. The workaround is to create a file and folder /metadata/local.meta in the installation tree of the app that the deployment server is deploying. (SPL-45019)

[edit]

to clarify the workaround :

if the problem is occurring with the app : myapp
on the deployment server on linux, do

mkdir $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/
touch $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/local.meta

it will create an empty local.meta file

then reload the deployment server
$SPLUNK_HOME/bin/splunk reload deploy-server

View solution in original post

yannK
Splunk Employee
Splunk Employee

Known Bug on Splunk 4.2.4/4.2.5
see http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues#Distributed_deployment.2...

Under certain circumstances when deploying apps in 4.2.4, the deployment client will return the following error message: Cannot update application info: /nobody/appname/app/install/state = enabled: Metadata could not be written: /nobody/appname/app/install/state: { }, removable: yes. The workaround is to create a file and folder /metadata/local.meta in the installation tree of the app that the deployment server is deploying. (SPL-45019)

[edit]

to clarify the workaround :

if the problem is occurring with the app : myapp
on the deployment server on linux, do

mkdir $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/
touch $SPLUNK_HOME/etc/deployment-apps/myapp/metadata/local.meta

it will create an empty local.meta file

then reload the deployment server
$SPLUNK_HOME/bin/splunk reload deploy-server

imacdonald2
Path Finder

I have been banging my head against the wall over this all day.

0 Karma

pavanae
Builder

I seen the same issue occurred in splunk 6.1.3.. and i did the same as you mentioned..But still i am unable to see any difference..I am still not able to see the logs..

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...