I tried running Splunk from within a zfs pool on FreeBSD 8.1 and it failed with a file system not supported error. Seeing that Splunk downloads are available for Solaris and FreeBSD, are there any plans for Splunk to be able to run from within a zfs pool or is that not feasible?
We are looking to use ZFS. Is there any update on this or has anyone opened an enhancement request yet?
I'm running splunk-6.0.2-196940-freebsd-7.3-amd64.tgz on a 9.1-RELEASE system, on a zfs volume and I have not had any problems
I too just installed Splunk on a new FreeBSD 9.0 server using zfs as my boot/os volume. To my dismay, Splunk cannot use zfs.
The suggested solutions are not ideal, can Splunk please support a filesystem that has been strongly marketed and recommended by the FreeBSD team?
Hi,
You can avoid the problem by creating a UFS filesystem on a ZFS partition.
zfs create -V 10g tank/ufs
newfs /dev/zvol/tank/ufs
mkdir /ufs
mount /dev/zvol/tank/ufs /ufs
Hope this helps,
Francois
It's a bug in the locktest binary. It doesn't actually test locking at all; it just has a whitelist of known filesystems, and if your fs isn't in that list, it fails. Two workarounds:
Use a binary editor on the locktest binary and replace one of the filesystems in the list ("nfs" for example) with "zfs".
Use LD_PRELOAD to pull in a shared object that wraps the fsstat() syscall and replaces "zfs" with "ufs". Luckily I created one to work around a similar bug in Symantec Netbackup 🙂 If you build the shared object from this post, all you need to do is add
export LD_PRELOAD=/usr/local/lib/fakegetfsstat.so
to your startup script, and splunk should work fine.
I can verify that splunk on ZFS in freebsd doesn't work.
Could not create a lock in the
SPLUNK_DB directory. Filesystem type
is not supported: buf.f_fstypename =
zfs If supporting this filesystem type
is important to you, please file an
Enhancement Request with Splunk
Support with the fs info number
listed. Locking test failed on
filesystem in path
/usr/local/splunk/var/lib/splunk with
code '9'. Please file a case online
at
http://www.splunk.com/page/submit_issue
Platform
SplunkIndexer# uname -a FreeBSD
SplunkIndexer 8.1-RELEASE FreeBSD
8.1-RELEASE #0: Mon Jul 19 02:36:49 UTC 2010
root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
amd64 SplunkIndexer#
To confirm compat6x is install:
SplunkIndexer# pkg_info -a | grep
compat Information for
compat6x-amd64-6.4.604000.200810_3:
Splunk does support ZFS on Solaris:
However, we do not officially support ZFS on FreeBSD. That said, if you have the compat6x package installed I would be surprised if we can't get a lock on the filesystem.