topic Universal Forwarder in Getting Data In

Universal Forwarder

drggfish1 — Sat, 20 Dec 2025 18:16:25 GMT

I am getting a mismatch between the version of OPENSSL installed on my OS and in the Universal Forwarder. It seems to be keeping me from running the Universal Forwarder as a systemd process.

NAME="AlmaLinux"
VERSION="10.1 (Heliotrope Lion)"

[splunk@ip-172-31-34-212 bin]$ openssl version
OpenSSL 3.5.1 1 Jul 2025 (Library: OpenSSL 3.5.1 1 Jul 2025)

systemctl: /opt/splunkforwarder/lib/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by /usr/lib64/systemd/libsystemd-shared-257-13.el10.alma.1.so)

Thanks

Re: Universal Forwarder

PickleRick — Sat, 20 Dec 2025 22:26:02 GMT

We had a similar question not long ago...

What _exactly_ are you doing? UF ships with own openssl version which should be used within UF and only within UF. So systemctl trying to use openssl seems either like a bug or you are doing something wrong way.

Re: Universal Forwarder

inventsekar — Sat, 20 Dec 2025 22:32:41 GMT

Hi @drggfish1

Pls check this post:

https://splunk.my.site.com/customer/s/article/OPENSSL-3-4-0-not-found-warning-message-after-splunk-enable-boot-start

Karma points appreciated, if this solves your issue, pls consider accepting it as solution, thanks..

Re: Universal Forwarder

ITWhisperer — Sun, 21 Dec 2025 09:58:42 GMT

openssl version shows which version is found by your shell.

Try bin/splunk cmd openssl version to find which version splunk is using.

Re: Universal Forwarder

kml_uvce — Sun, 21 Dec 2025 14:31:09 GMT

Rename/remove Splunk's OpenSSL libraries

cd /opt/splunkforwarder/lib
sudo mv libcrypto.so.3 libcrypto.so.3.bak
sudo mv libssl.so.3 libssl.so.3.bak

Then try starting the forwarder again:

sudo systemctl start SplunkForwarder

Re: Universal Forwarder

PickleRick — Sun, 21 Dec 2025 22:16:03 GMT

That will effectively cripple, if not completely break, the UF since it will have no openssl libraries to use.