All Apps and Add-ons

Are there plans for splunk to support zfs?

spoon
Engager

I tried running Splunk from within a zfs pool on FreeBSD 8.1 and it failed with a file system not supported error. Seeing that Splunk downloads are available for Solaris and FreeBSD, are there any plans for Splunk to be able to run from within a zfs pool or is that not feasible?

Tags (1)

jonathon
Path Finder

We are looking to use ZFS. Is there any update on this or has anyone opened an enhancement request yet?

0 Karma

mcarlson
Explorer

I'm running splunk-6.0.2-196940-freebsd-7.3-amd64.tgz on a 9.1-RELEASE system, on a zfs volume and I have not had any problems

0 Karma

mcarlson
Explorer

I too just installed Splunk on a new FreeBSD 9.0 server using zfs as my boot/os volume. To my dismay, Splunk cannot use zfs.

The suggested solutions are not ideal, can Splunk please support a filesystem that has been strongly marketed and recommended by the FreeBSD team?

0 Karma

mr_jolly
Engager

Hi,

You can avoid the problem by creating a UFS filesystem on a ZFS partition.

zfs create -V 10g tank/ufs
newfs /dev/zvol/tank/ufs
mkdir /ufs
mount /dev/zvol/tank/ufs /ufs

Hope this helps,

Francois

dnelson
Engager

It's a bug in the locktest binary. It doesn't actually test locking at all; it just has a whitelist of known filesystems, and if your fs isn't in that list, it fails. Two workarounds:

  1. Use a binary editor on the locktest binary and replace one of the filesystems in the list ("nfs" for example) with "zfs".

  2. Use LD_PRELOAD to pull in a shared object that wraps the fsstat() syscall and replaces "zfs" with "ufs". Luckily I created one to work around a similar bug in Symantec Netbackup 🙂 If you build the shared object from this post, all you need to do is add

export LD_PRELOAD=/usr/local/lib/fakegetfsstat.so

to your startup script, and splunk should work fine.

bhieric
New Member

I can verify that splunk on ZFS in freebsd doesn't work.

Could not create a lock in the
SPLUNK_DB directory. Filesystem type
is not supported: buf.f_fstypename =
zfs If supporting this filesystem type
is important to you, please file an
Enhancement Request with Splunk
Support with the fs info number
listed. Locking test failed on
filesystem in path
/usr/local/splunk/var/lib/splunk with
code '9'. Please file a case online
at
http://www.splunk.com/page/submit_issue

Platform

SplunkIndexer# uname -a FreeBSD
SplunkIndexer 8.1-RELEASE FreeBSD
8.1-RELEASE #0: Mon Jul 19 02:36:49 UTC 2010

root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
amd64 SplunkIndexer#

To confirm compat6x is install:

SplunkIndexer# pkg_info -a | grep
compat Information for
compat6x-amd64-6.4.604000.200810_3:

0 Karma

araitz
Splunk Employee
Splunk Employee

Splunk does support ZFS on Solaris:

http://www.splunk.com/base/Documentation/latest/Installation/Systemrequirements#Supported_file_syste...

However, we do not officially support ZFS on FreeBSD. That said, if you have the compat6x package installed I would be surprised if we can't get a lock on the filesystem.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...