Monitor your universal forwarder upgrade status

Verify that your upgrade is successful

Verify that your upgrade is successful using the following search on the search heads:

index=_internal source=*splunk-upgrade* Upgrade has been completed successfully.

About update failures

The Remote Upgrader for Linux Universal Forwarders provides retry and timeout mechanisms to mitigate upgrade issues. By default the Remote Upgrader for Linux Universal Forwarders will retry the upgrade three times, with a 300 second timeout. If the upgrade still fails, the Remote Upgrader for Linux Universal Forwarders marks the upgrade as failed. The retry and timeout configurations are configurable in the local_config file:

FWD_UPGRADE_TIMEOUT_SEC=300

FWD_UPGRADE_MAX_RETRY=3

When an upgrade fails, the Remote Upgrader for Linux Universal Forwarders will roll back to the previous version as follows:

1. The Remote Upgrader for Linux Universal Forwarders backs up the existing SPLUNK_HOME directory before upgrade.
2. A new directory is created under the ./history directory.
3. If an automatic update fails, the Remote Upgrader for Linux Universal Forwarders automatically restores this backup. This ensures that the universal forwarder continues to function, especially in a deployment server deployment, and gives you the opportunity to triage or fix the upgrade issues.