Ask Your Question

MD5 of unchanged file changes on each run

asked 2015-02-19 16:35:18 -0600

earixson gravatar image

I've written out a splunk inputs.conf file using a Hiera hash and a template. The MD5 changes on each run, rewriting the file and restarting my Splunk service unnecessarily.

When I take copies of the files and run them through diff and md5sum they turn out identical. So something in Puppet is seeing a change that I'm just not seeing. I assume I'm missing something obvious. any ideas? I've seen several similar problems either here or in old bug reports but none of the fixes have worked for me.

The Hiera .yaml looks like this:

    disabled: 'false'
    recursive: 'false'
    index:    'intranet'
    ignoreOlderThan: '7d'
    sourcetype: 'sitecore_searchlog'
    disabled: 'false'
    recursive: 'false'
    index:    'intranet'
    ignoreOlderThan: '7d'
    sourcetype: 'sitecore_publishinglog'
    disabled: 'false'
    recursive: 'false'
    index:    'intranet'
    ignoreOlderThan: '7d'
    sourcetype: 'sitecore_crawlinglog'

The .erb looks like this:

<% @inputs.sort.each do |path, settings| -%>
[monitor://<%= path %>]
<% settings.sort.each do |key,value| -%>
<%=key%> = <%=value%>

The manifest looks like this:

class site::win_splunk {
require splunk::forwarder

$inputs = hiera_hash(win_splunk::inputs)
file { 'inputs.conf':
path    => 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf',
  content =>  template('/etc/puppet/environments/production/modules/site/templates/splunk/inputs.conf.erb'),
  notify  =>  Service['SplunkForwarder'],


The output of a puppet agent run:

    C:\Program Files\Puppet Labs\Puppet\bin>puppet agent --test
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for hostname.domain.tld
Info: Applying configuration version '1424384337'
Notice: /Stage[main]/Splunk::Forwarder/Splunkforwarder_input[default_host]/ensure: created
Info: /Stage[main]/Splunk::Forwarder/Splunkforwarder_input[default_host]: Scheduling refresh of Service[SplunkForwarder]
Notice: /Stage[main]/Site::Win_splunk/File[inputs.conf]/content:
Info: Computing checksum on file C:/Program Files/SplunkUniversalForwarder/etc/system/local/inputs.conf
Info: /Stage[main]/Site::Win_splunk/File[inputs.conf]: Filebucketed C:/Program Files/SplunkUniversalForwarder/etc/system/local/inputs.conf to main with sum 58fbab01b5af60e2ffb778a261edd0a7
Notice: /Stage[main]/Site::Win_splunk/File[inputs.conf]/content: content changed '{md5}58fbab01b5af60e2ffb778a261edd0a7' to '{md5}536375e7931d1396b10e8a1876fbc215'
Info: /Stage[main]/Site::Win_splunk/File[inputs.conf]: Scheduling refresh of Service[SplunkForwarder]
Notice: /Stage[main]/Splunk::Virtual/Service[SplunkForwarder]: Triggered 'refresh' from 2 events
Notice: Finished catalog run in 16.83 seconds
edit retag flag offensive close merge delete


It's a longshot, since I haven't used Puppet on Windows much, but could it be a mismatch in line endings between your .erb file and what Windows expects? Perhaps try converting the files that will be delivered to your Windows nodes to have correct line endings, i.e.:

GregLarkin gravatar imageGregLarkin ( 2015-02-20 00:05:49 -0600 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2015-03-05 15:30:57 -0600

earixson gravatar image

so i figured it out: puppetlabs-splunk rewrites inouts.conf with some default values on each run. my hiera-driven class then writes out from the template.

Since puppetlabs-splunk doesn't appear to have a real robust way of managing the inouts.conf files, I didn't ecpext it would be actively managing them,

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2015-02-19 16:35:18 -0600

Seen: 936 times

Last updated: Mar 05 '15