w3ttr3y / puppet-module-splunk Goto Github PK

http://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStartPre=

ExecStartPre can be used to run commands before the start command executes. We should use this to chown $SPLUNK_HOME and $SPLUNK_DB

Alternatively, we could parse index locations and chown them.

If we change the user (e.g. from Splunk to Splunk2), does it do the right thing?

Update init script, file permissions, splunk-launch.conf etc

What about purging old users/group?

This is complicated as if there are multiple instance, I really don't want to copy the file multiple times. I can't think of a way to do that without leaving a stale tar file laying around.

The problem is if we have two instance of a version and then one gets purged. One wants to purge the staged file, the other wants it.

There may be a clever way with virtual resources; otherwise I think Ruby code would be involved. I had hope the puppetlabs staging module would solve this issue, but I similarly have a stale file laying around in my tests.

I noticed that on our indexers at work, Splunk is taking a long time to shut down. Eventually it'll hit a five minute timeout in Systemd.

Obviously, this is less then desireable, especially when shutting down / restarting the operating system.

To avoid this issue, we should set TimeoutStopSec

http://www.freedesktop.org/software/systemd/man/systemd.service.html#TimeoutStopSec=

Be able to install via a package

Add support for native systemd

I think this could be cleaner then trying to work within the traditional init system.

Using a template we could do something like:

[Unit]
Description=Splunk ${instance}
Wants=network.target
After=network.target

[Service]
Type=forking
RemainAfterExit=yes
ExecStart=${splunk_home}/bin/splunk start --answer-yes --no-prompt --accept-license
ExecStop=${splunk_home}/bin/splunk stop
ExecReload=${splunk_home}/bin/splunk restart
StandardOutput=syslog

[Install]
WantedBy=multi-user.target

http://www.freedesktop.org/wiki/Software/systemd/Incompatibilities/

Mentions using pidfile option so that systemd will know what the main process is and will know if the service has stopped.

This should allow us to stop splunk with $SPLUNK_HOME/bin/splunk and now that it was stopped.

This will be interesting in cases like deployer and deployment server where they restart Splunk as systemd will know that SPlunk stopped. We'll need to configure it to NOT automatically restart Splunk. Maybe with a timeout we can restart it with systemd.

According to duckfez:
"somewhere in the docs they suggest a "splunk disable boot-start && splunk enable boot-start -user splunk" on non-patchlevel upgrades"

For at least the changes with eliminating the use of sudo that makes a lot of sense and is something we should implement.

Apply the correction I posted https://answers.splunk.com/answers/307112/why-am-i-getting-an-installation-failure-for-splun.html

Define what we want in our basic configuration.

splunkd port
SSL?
user

?????

Adjust ulimit settings on start.

I read that you can do this with a systemd service unit file; look into doing it for init scripts also.

Basically what I'm doing on the file copy is I'm using validate_cmd so that if we aren't updating Splunk, then we won't copy over the TGZ if it doesn't exist locally. The problem is that when the file doesn't exist and not update is needed, it prints a warning.

At least for .tgz installs, support having multiple instances.