topic Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer? in Getting Data In

Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

ayushchoudhary — Fri, 11 Sep 2015 06:46:09 GMT

I got this error while starting Splunk on the indexer.

homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem. Validating databases (splunkd validatedb) failed with code '1'.

Please help urgently.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

naisanza — Mon, 25 Apr 2016 20:13:03 GMT

You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

Note from malmoore (Splunk): As of 28 March 2018, this workaround has been officially documented in the Troubleshooting Manual. See Splunk Enterprise does not start due to unusable filesystem in the manual for the procedure.

The caveats for using this workaround still apply. Proceed with caution, and at your own risk. Irrevocable data loss can still occur. We have already had one report in this thread of problems that have occurred after enabling this setting.

Key points (as of 24 April 2018)

There is still no support for macOS 10.13 High Sierra on Splunk Enterprise version 7.0.
There is work scheduled to fix the problem for macOS 10.13 on Splunk Enterprise 7.0 and reinstate support, but there is no promise of delivery of this functionality.
There is support for macOS 10.13 High Sierra on APFS on Splunk Enterprise version 7.1.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

heynash — Tue, 16 Aug 2016 20:56:22 GMT

This was spot on for me. Great advice, thanks.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

s2_splunk — Wed, 17 Aug 2016 04:20:15 GMT

Careful. This is an indication that you may have Splunk deployed on top of an unsupported filesystem that does not implement required file locking mechanism. Setting that attribute in splunk-launch.conf is overriding our internal file locking test during startup. YMMV...

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

Dimitri_McKay — Wed, 17 Aug 2016 15:36:24 GMT

Actually, this worked perfect for me too. I'm running Sierra beta and two of my instances complained about this. So it may be OS X Beta related.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

vbumgarner — Wed, 21 Sep 2016 20:23:34 GMT

This is still required on the public release of Sierra.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

ff_rumali — Tue, 22 Nov 2016 22:04:17 GMT

The comment from Dimitri mentioning Sierra triggered me to try this configuration option. It worked for me on my recently upgraded MacBook.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

vbumgarner — Tue, 29 Sep 2020 12:40:57 GMT

After using this flag for awhile, I'm now getting:

WARN JournalSlice - Error reading from fresh journal slice file ".../db/hot_v1_4937/rawdata/1971039751": Input/output error

Is this related, or do I just have a bad disk?

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

yannK — Sat, 11 Mar 2017 21:24:23 GMT

This is fixed in splunk 6.5.*, the problem was for MACOS Sierra filesystem check.
For older versions you could use the workaround above, or upgrade.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

starcher — Tue, 26 Sep 2017 15:38:26 GMT

This works again to get started on OSX High Sierra

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

Jason_S — Tue, 29 Sep 2020 15:57:30 GMT

The 'OPTIMISTIC_ABOUT_FILE_LOCKING = 1' appears to only be needed for OSX High Sierra running off a APFS volume. My High Sierra system running off a Mac OS Extended volume did not need this setting.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

Sp1unkin_it — Thu, 28 Sep 2017 16:40:09 GMT

Thank you for this.

I ran into the same error this morning when I was installing Splunk 7.0 on Mac OS High Sierra.

This resolved the issue.

Splunkin' it!

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

Jason_S — Thu, 28 Sep 2017 17:15:03 GMT

yannK: I had this issue using Splunk 7.0.0 on High Sierra using APFS and have filed a support case requesting APFS support.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

starcher — Fri, 29 Sep 2017 15:19:29 GMT

Yeah it is the file system type being the problem.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

hardikJsheth — Tue, 29 Sep 2020 16:06:07 GMT

I had the same problem after upgrading to Splunk 7.0 on my mac. After I added OPTIMISTIC_ABOUT_FILE_LOCKING = 1, I was able to start the splunk.

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

zakxu8 — Tue, 29 Sep 2020 16:18:10 GMT

guys, anyone can help me. i have problem with my splunk cannot run since i have upgrade my mac os sierra to mac os high sierra 10.13

there are message :

Traceback (most recent call last):
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/site-packages/splunk/clilib/cli.py", line 17, in
import splunk.clilib.cli_common as comm
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 10, in
from xml.sax import saxutils
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/xml/sax/saxutils.py", line 6, in
import os, urlparse, urllib, types
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/urllib.py", line 1440, in
from _scproxy import _get_proxy_settings, _get_proxies
ImportError: dlopen(/Users/zakaria/Documents/splunk-old/lib/python2.7/lib-dynload/_scproxy.so, 2): Symbol not found: _inflateValidate
Referenced from: /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
Expected in: /Users/zakaria/Documents/splunk-old/lib/libz.1.dylib
in /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib

i have add to my splunk-launch.cof OPTIMISTIC_ABOUT_FILE_LOCKING = 1
but still doesn't work. anyone can hel me? thanks

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

aharkare — Tue, 29 Sep 2020 16:55:40 GMT

After adding 'OPTIMISTIC_ABOUT_FILE_LOCKING = 1' in $SPLUNK_HOME/etc/splunk-launch.conf, it worked for Mac OS High Sierra 10.13.1 (17B48).

Thank you so much for the suggestion!

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

aharkare — Tue, 29 Sep 2020 16:37:03 GMT

After adding OPTIMISTIC_ABOUT_FILE_LOCKING = 1 to splunk-launch.conf file it worked for Mac OS High Sierra Version 10.13.1 (17B48). Thank you so much for the suggestion!

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

potap75 — Sat, 11 Nov 2017 17:45:58 GMT

Same here! Thank you!

Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

tcccorp — Mon, 20 Nov 2017 15:55:29 GMT

Hello,

I had the same issue with the latest version under ubuntu 16.04 ( I used the tgz version) . I added the line on the conf file and now it works !

Thanks fir this help