Install splunk forwarder on VmWare Center photon OS?

[abdullahalhabba]

Hi Splunker;

When I install splunk forwarder on VmWare Center photon OS and after run this command /opt/splunk/bin/splunk enable boot-start -user splunk, appeared the following error:

service splunk does not support chkconfig

Please we need your support.

[jethompson_splu]

@abdullahalhabbash -- To be honest there is not enough information in your Post to provide insight to the issue that you are experiencing. There could be a couple of different types of Causes to this issue and without further details in regards to Errors being seen or steps that have been taken in an attempt to resolve this OS Level issue.

Now with that being said, while working with a Co-Worker on this very issue we were able to identify a cause and wanted to provide the potential Solution for the issue that you have experienced:

1) While attempting to run: $SPLUNK_HOME/bin/splunk enable boot-start -user splunk The following Error is produced

service splunk does not support chkconfig

2) In an attempt to troubleshoot this issue at the OS Level we reviewed the following:

A) Completed an Strace Against the following Splunk Command to see what the command was actually doing:
strace $SPLUNK_HOME/bin/splunk enable boot-start -user splunk 

From the Output of the Strace completed it was noticed that one of the C Library Calls that Splunk makes to complete the "Enable Boot-Start" Process appeared to be using an Older Library Call. As such this caused us to run the following command set on the PhotonOS Instance:

tdnf update -y

During this Update process the following System Process was updated: SystemCTL (systemD) and this was updated to Version 228. Once this Package update was completed we were then able to re-issue the following Command Set without any issues:

$SPLUNK_HOME/bin/splunk enable boot-start -user splunk

This completed as expected and as such the issue that was being experienced was directly due to the version of SystemCTL (systemD) that was in use. It appears that this Instance might be using a "Non-Mainstream" branch of the systemD Libraries and as such this could potentially cause all sorts of different issues around Permissions at the OS Level.

This issue is not a Splunk Product issue but the OS itself. The OS appears to be using a set of Linux OS Libraries that is not considered "Mainstream" and as such Your Millage May Vary with this Minimal Linux Installation Distro produced by VMWare.

Hopefully this information helps others that experience an issue when attempting to Enable Boot-Start for Splunk Forwarder running inside of the PhotonOS.

[abdullahalhabba]

Thank you;

I tried all of the above did not help me

[mayurr98]

have you looked at this 2 answers?
https://answers.splunk.com/answers/34628/does-splunk-support-redhat-chkconfig.html
https://answers.splunk.com/answers/683828/how-do-we-enable-a-forwarder-boot-start.html

let me know if this helps!