I started using this flag within the serverclass.conf of our deployment server as document [here][1]
restartIfNeeded = true | false
* This is only valid on forwarders that are newer than 6.4.
* If true and issueReload is also true, then when an updated app is delpoyed
to the client, that client will try to reload that app. If it fails, it will
then restart.
* defaults to false
This flag appears to work fine for my purposes, at least most of the time.
However I've hit an edge case where we removed a few servers from the list and therefore the uninstall was triggered for the TA-nmon - Technical Addon for Nmon Performance Monitor add-on. However the issue was that post uninstallation the universal forwarder continued to attempt to run the scheduled execution of a script every minute (which failed because the application was deleted).
The issue isn't major but was a little bit annoying, a restart of the universal forwarder resolved the issue.
Is this expected with this flag? Or in general? Does uninstalling an application via a deployment server not trigger a restart if needed?
[1]: https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Serverclassconf
↧