Ask Your Question
0

MD5 of unchanged file changes on each run

asked 2015-02-19 16:35:18 -0500

earixson gravatar image

I've written out a splunk inputs.conf file using a Hiera hash and a template. The MD5 changes on each run, rewriting the file and restarting my Splunk service unnecessarily.

When I take copies of the files and run them through diff and md5sum they turn out identical. So something in Puppet is seeing a change that I'm just not seeing. I assume I'm missing something obvious. any ideas? I've seen several similar problems either here or in old bug reports but none of the fixes have worked for me.

The Hiera .yaml looks like this:

win_splunk::inputs:
  'C:\inetpub\wwwroot\intranet\Data\logs\Search*':
    disabled: 'false'
    recursive: 'false'
    index:    'intranet'
    ignoreOlderThan: '7d'
    sourcetype: 'sitecore_searchlog'
  'C:\inetpub\wwwroot\intranet\Data\logs\Publishing*':
    disabled: 'false'
    recursive: 'false'
    index:    'intranet'
    ignoreOlderThan: '7d'
    sourcetype: 'sitecore_publishinglog'
  'C:\inetpub\wwwroot\intranet\Data\logs\Crawling*':
    disabled: 'false'
    recursive: 'false'
    index:    'intranet'
    ignoreOlderThan: '7d'
    sourcetype: 'sitecore_crawlinglog'

The .erb looks like this:

<% @inputs.sort.each do |path, settings| -%>
[monitor://<%= path %>]
<% settings.sort.each do |key,value| -%>
<%=key%> = <%=value%>
<%end%>
<%end%>

The manifest looks like this:

class site::win_splunk {
require splunk::forwarder

$inputs = hiera_hash(win_splunk::inputs)
file { 'inputs.conf':
path    => 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf',
  content =>  template('/etc/puppet/environments/production/modules/site/templates/splunk/inputs.conf.erb'),
  notify  =>  Service['SplunkForwarder'],
  }

}

The output of a puppet agent run:

    C:\Program Files\Puppet Labs\Puppet\bin>puppet agent --test
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for hostname.domain.tld
Info: Applying configuration version '1424384337'
Notice: /Stage[main]/Splunk::Forwarder/Splunkforwarder_input[default_host]/ensure: created
Info: /Stage[main]/Splunk::Forwarder/Splunkforwarder_input[default_host]: Scheduling refresh of Service[SplunkForwarder]
Notice: /Stage[main]/Site::Win_splunk/File[inputs.conf]/content:
Info: Computing checksum on file C:/Program Files/SplunkUniversalForwarder/etc/system/local/inputs.conf
Info: /Stage[main]/Site::Win_splunk/File[inputs.conf]: Filebucketed C:/Program Files/SplunkUniversalForwarder/etc/system/local/inputs.conf to main with sum 58fbab01b5af60e2ffb778a261edd0a7
Notice: /Stage[main]/Site::Win_splunk/File[inputs.conf]/content: content changed '{md5}58fbab01b5af60e2ffb778a261edd0a7' to '{md5}536375e7931d1396b10e8a1876fbc215'
Info: /Stage[main]/Site::Win_splunk/File[inputs.conf]: Scheduling refresh of Service[SplunkForwarder]
Notice: /Stage[main]/Splunk::Virtual/Service[SplunkForwarder]: Triggered 'refresh' from 2 events
Notice: Finished catalog run in 16.83 seconds
edit retag flag offensive close merge delete

Comments

It's a longshot, since I haven't used Puppet on Windows much, but could it be a mismatch in line endings between your .erb file and what Windows expects? Perhaps try converting the files that will be delivered to your Windows nodes to have correct line endings, i.e.: http://bit.ly/1ia6RCQ

GregLarkin gravatar imageGregLarkin ( 2015-02-20 00:05:49 -0500 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2015-03-05 15:30:57 -0500

earixson gravatar image

so i figured it out: puppetlabs-splunk rewrites inouts.conf with some default values on each run. my hiera-driven class then writes out from the template.

Since puppetlabs-splunk doesn't appear to have a real robust way of managing the inouts.conf files, I didn't ecpext it would be actively managing them,

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2015-02-19 16:35:18 -0500

Seen: 628 times

Last updated: Mar 05 '15