diff --git a/README.md b/README.md index fe1acb5..d160ab7 100644 --- a/README.md +++ b/README.md @@ -138,15 +138,19 @@ This app contains scripts for Windows and Linux forwarders that will move the ex Windows - `regenGUID.ps1`\ \*Nix - `regenGUID.sh` -###### Install updated datetime.xml file -A notice was sent out in November of 2019 that stated there was an issue with the datetime.xml that would affect data ingested due to a misconfigured datetime.xml. The bug and fix can be read about here: https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020 +###### Install updated datetime.xml file (REMOVED) +The scripts that performed this action have been retired. This method is also not the safest method to update this file and should not be used. It is preferable to simply upgrade Splunk version (Splunk Enterprise or Splunk Universal Forwarder) that already has this fix in place. -This app contains scripts for Windows and Linux forwarders that will back up the existing "datetime.xml" to replace with the corrected version contained within the app. +https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020#Upgrade_Splunk_platform_instances_to_a_version_with_an_updated_version_of_datetime.xml -**NOTE: This should only be used on Universal Forwarders. Please see the above documentation link for instructions for other Splunk instances.** +~~A notice was sent out in November of 2019 that stated there was an issue with the datetime.xml that would affect data ingested due to a misconfigured datetime.xml. The bug and fix can be read about here: https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020~~ -Windows - `dateTimeCorrect.ps1`\ -\*Nix - `dateTimeCorrect.sh` +~~This app contains scripts for Windows and Linux forwarders that will back up the existing "datetime.xml" to replace with the corrected version contained within the app.~~ + +~~**NOTE: This should only be used on Universal Forwarders. Please see the above documentation link for instructions for other Splunk instances.**~~ + +~~Windows - `dateTimeCorrect.ps1`\ +\*Nix - `dateTimeCorrect.sh`~~ ###### Update default 'changeme' password on Splunk Forwarders (primary installations before 7.1.0) Forwarders deployed before version 7.1.0 didn't require the admin password be changed upon installation. Starting at 7.1.0, the forwarders required either a user-seed file or manual input of the password during first-time run. While the REST API of the forwarder is not configured to allow POST requests until the password is changed on versions prior to 7.1.0, changing the password is still recommended. diff --git a/bin/dateTimeCorrect.ps1 b/bin/dateTimeCorrect.ps1 deleted file mode 100644 index 2f36317..0000000 --- a/bin/dateTimeCorrect.ps1 +++ /dev/null @@ -1,17 +0,0 @@ -### Capture current values for forwarder and configure file path variables for the system -$existingDateTime = "$SPLUNKHOME\etc\datetime.xml" -$referenceDateTime = "$SPLUNKHOME\apps\SplunkForwarderRepairKit\datetime.xml" -$restartDateTimeCheck = "$SPLUNKHOME\etc\restartdatetime.txt" - -### Filter to attach timestamps where necessary -filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"} - -### Check flags and take appropriate actions for host name -if(Compare-Object -ReferenceObject $(Get-Content $existingDateTime) -DifferenceObject $(Get-Content $referenceDateTime)) { - Write-output "The datetime.xml file needs to be updated. Updating..." | timestamp - Copy-Item -Path "$existingDateTime" -Destination "$existingDateTime_$(Get-Date -Format 'MMddyyyy').bak" - Copy-Item -Path "$referenceDateTime" -Destination "$existingDateTime" - Out-File -FilePath "$restartDateTimeCheck" -} else { - Write-output "The datetime.xml is the updated version. No correction necessary..." | timestamp -} diff --git a/bin/dateTimeCorrect.sh b/bin/dateTimeCorrect.sh deleted file mode 100755 index 26978fe..0000000 --- a/bin/dateTimeCorrect.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash -### Determine the difference in the reference datetime.xml in the app and the datetime.xml currently used by Splunk -EXISTING_DATETIME="$SPLUNK_HOME/etc/datetime.xml" -REFERENCE_DATETIME="$SPLUNK_HOME/etc/apps/SplunkForwarderRepairKit/datetime.xml" -DATETIME_DIFFERENCE=$(diff $REFERENCE_DATETIME $EXISTING_DATETIME | wc -l) -RESTART_DATETIME_CHECK="$SPLUNK_HOME/etc/restartdatetime.txt" - -### Determine if a correction is necessary -if [ $DATETIME_DIFFERENCE = 0 ]; then - echo "$(date -R) ${HOSTNAME}: The datetime.xml is the updated version. No correction necessary..." -else - echo "$(date -R) ${HOSTNAME}: The datetime.xml file needs to be updated. Updating..." - mv $EXISTING_DATETIME $EXISTING_DATETIME.$(date +"%m%d%Y") - cp $REFERENCE_DATETIME $EXISTING_DATETIME - touch $RESTART_DATETIME_CHECK -fi diff --git a/bin/restart.ps1 b/bin/restart.ps1 index f89141a..131d778 100644 --- a/bin/restart.ps1 +++ b/bin/restart.ps1 @@ -3,17 +3,15 @@ $inputPath = "$SPLUNKHOME\etc\restartinput.txt" $serverPath = "$SPLUNKHOME\etc\restartserver.txt" $dsPath = "$SPLUNKHOME\etc\restartds.txt" $guidPath = "$SPLUNKHOME\etc\restartguid.txt" -$dateTimePath = "$SPLUNKHOME\etc\restartdatetime.txt" $restartInput = $(Test-Path "$SPLUNKHOME\etc\restartinput.txt" -PathType Leaf) $restartServer = $(Test-Path "$SPLUNKHOME\etc\restartserver.txt" -PathType Leaf) $restartDS = $(Test-Path "$SPLUNKHOME\etc\restartds.txt" -PathType Leaf) $restartGUID = $(Test-Path "$SPLUNKHOME\etc\restartguid.txt" -PathType Leaf) -$restartDateTime = $(Test-Path "$SPLUNKHOME\etc\restartdatetime.txt" -PathType Leaf) ### Filter to attach timestamps where necessary filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"} -if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "True" -OR $restartGUID -eq "True" -OR $restartDateTime -eq "True") { +if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "True" -OR $restartGUID -eq "True") { Write-output "One or more settings has been changed." | timestamp Write-output "Restarting forwarder." | timestamp if ($restartInput -eq "True") { @@ -28,9 +26,6 @@ if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "T if ($restartGUID -eq "True") { Remove-Item -path "$guidPath" } - if ($restartDateTime -eq "True") { - Remove-Item -path "$dateTimePath" - } Remove-Item -path "$PSScriptRoot\DeleteMeToRestart" } else { Write-output "No settings have been changed." | timestamp diff --git a/bin/restart.sh b/bin/restart.sh index ecc62e3..6353545 100755 --- a/bin/restart.sh +++ b/bin/restart.sh @@ -7,10 +7,9 @@ RESTARTINPUT="$SPLUNK_HOME/etc/restartinput.txt" RESTARTSERVER="$SPLUNK_HOME/etc/restartserver.txt" RESTARTDS="$SPLUNK_HOME/etc/restartds.txt" RESTARTGUID="$SPLUNK_HOME/etc/restartguid.txt" -RESTARTDATETIME="$SPLUNK_HOME/etc/restartdatetime.txt" ### If any files exist, restart forwarder -if [ -f "$RESTARTINPUT" ] || [ -f "$RESTARTSERVER" ] || [ -f "$RESTARTDS" ] || [ -f "$RESTARTGUID" ] || [ -f "$RESTARTDATETIME" ]; then +if [ -f "$RESTARTINPUT" ] || [ -f "$RESTARTSERVER" ] || [ -f "$RESTARTDS" ] || [ -f "$RESTARTGUID" ]; then echo "$(date -R) ${HOSTNAME}: One or more settings has been changed." echo "$(date -R) ${HOSTNAME}: Restarting forwarder." if [ -f "$RESTARTINPUT" ]; then @@ -25,9 +24,6 @@ if [ -f "$RESTARTINPUT" ] || [ -f "$RESTARTSERVER" ] || [ -f "$RESTARTDS" ] || [ if [ -f "$RESTARTGUID" ]; then rm -f "$RESTARTGUID" fi - if [ -f "$RESTARTDATETIME" ]; then - rm -f "$RESTARTDATETIME" - fi rm -f "${APP_PATH}/bin/DeleteMeToRestart" else echo "$(date -R) ${HOSTNAME}: No settings have been changed." diff --git a/datetime.xml b/datetime.xml deleted file mode 100644 index e7b2a82..0000000 --- a/datetime.xml +++ /dev/null @@ -1,225 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \s* - - - - - - - \s* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/default/app.conf b/default/app.conf index 771fc72..8ff339b 100644 --- a/default/app.conf +++ b/default/app.conf @@ -7,3 +7,6 @@ check_for_updates = false [ui] is_visible = false is_manageable = false + +[launcher] +version = 2.0.0 diff --git a/default/inputs.conf b/default/inputs.conf index c359b26..f7e6f67 100644 --- a/default/inputs.conf +++ b/default/inputs.conf @@ -61,23 +61,7 @@ sourcetype = ds_remove:output source = ds_remove_output script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dsRemove.ps1" deploymentServerUri = -deploymentClientApp = - -### Scripts used to correct issues with datetime.xml -### https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020 -[script://./bin/dateTimeCorrect.sh] -disabled = 1 -index = _internal -sourcetype = datetime_correct:output -interval = -1 -source = datetime_correct_output - -[powershell://dateTimeCorrect] -disabled = 1 -index = _internal -sourcetype = datetime_correct:output -source = datetime_correct_output -script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dateTimeCorrect.ps1" +deploymentClientApp = ### Admin password change scripts [script://./bin/pwchange.sh] diff --git a/default/limits.conf b/default/limits.conf deleted file mode 100644 index b4470b8..0000000 --- a/default/limits.conf +++ /dev/null @@ -1,2 +0,0 @@ -[system_checks] -installed_files_integrity = log_only \ No newline at end of file