An app with deployer_push_mode = local_only overrides default\app.conf on the SHC

[NoSpaces]

Hello everyone!
This is not a significant issue, but sometimes I observe a somewhat strange behavior after pushing a configuration bundle from the deployer.
I have numerous default apps containing an app.conf file under the local directory with the content below:

"C:\Program Files\Splunk\etc\shcluster\apps\search\local\app.conf"
>
[shclustering]
deployer_push_mode = local_only

 
To push a bundle I use this command:

splunk apply shcluster-bundle -target $host -auth $authString -push-default-apps yes --answer-yes

After successfully pushing the bundle, I sometimes observe the warning below on a random search head:

File Integrity checks found 4 files that did not match the system-provided manifest. 

And it's always app.conf for example: 'C:\Program Files\Splunk\etc\apps\search\default\app.conf'

Is there a way to fix this? Or maybe I'm doing something wrong?
Am I wrong to expect that 'local_only' mode never touches the 'default' directory on the target host?

[kiran_panchavat]

@NoSpaces 

In general, there are four modes of deployer_push_mode:

- full

- merge_to_default

- local_only

- default_only

By default merge_to_default setting is enabled.

- If set to "full": Bundles all of the app's contents located in default/, local/, users/<app>/, and other app subdirs. It then pushes the bundle to the members. When applying the bundle on a member, the non-local and non-user configurations from the deployer's app folder are copied to the member's app folder, overwriting existing contents. Local and user configurations are merged with the corresponding folders on the member, such that member configuration takes precedence. This option should not be used for built-in apps, as overwriting the member's built-in apps can result in adverse behavior.

- If set to "merge_to_default": Merges the local and default folders into the default folder and pushes the merged app to the members. When applying the bundle on a member, the default configuration on the member is overwritten. User configurations are copied and merged with the user folder on the member, such that the existing configuration on the member takes precedence.

- * If set to "local_only": This option bundles the app's local directory (and its metadata) and pushes it to the cluster. When applying the bundle to a member, the local configuration from the deployer is merged with the local configuration on the member, such that the member's existing configuration takes precedence. Use this option to push the local configuration of built-in apps, such as search. If used to push an app that relies on non-local content (such as default/ or bin/), these contents must already exist on the member.

- If set to "local_only": This option bundles the app's local directory (and its metadata) and pushes it to the cluster. When applying the bundle to a member, the local configuration from the deployer is merged with the local configuration on the member, such that the member's existing configuration takes precedence. Use this option to push the local configuration of built-in apps, such as search. If used to push an app that relies on non-local content (such as default/ or bin/), these contents must already exist on the member.

Based on your requirement you can change the deployer_push_mode.

It is highly advisable to review the document below to gain a clear understanding of the behavior before implementing any changes.

https://docs.splunk.com/Documentation/Splunk/9.3.1/DistSearch/PropagateSHCconfigurationchanges#Choos... 

[NoSpaces]

It seems that you misunderstood my question a bit.
Every app has a deployer_push_mode setting,
and as I said, the affected apps use deployer_push_mode = local_only.

[livehybrid]

Hi @NoSpaces 

This is odd behaviour - as you say you would not expect any changes to the default app.conf when using local_only. 

Do you notice anything change in the search/default/app.conf compared to what it should be out of the box?

I would suggest contacting Splunk Support about this and get it raised as a bug - or perhaps they can give additional insight into this!

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[NoSpaces]

The edited app.conf has additional line indicating the fact that app was configured:

[install]
is_configured = true
state = enabled
allows_disable = false
install_source_checksum = <checksum>