All Apps and Add-ons

Mac OS Yosemite - How to start at boot time?

letsee
Engager

Before upgrading to Yosemite the boot-enable feature was working but now getting an error that says "hostconfig file not found". I checked the file and it has been removed for Yosemite. Any way to get the boot start to work?

1 Solution

mdonnelly_splun
Splunk Employee
Splunk Employee

In Splunk 6.2.1 (and older), the "enable boot-start" on the Mac relies on the StartupItems feature of OSX. The StartupItems feature was deprecated awhile back, OS X Yosemite removed support completely. With Yosemite, Apple relies on "launchd/launchctl" for process startup.

SERIOUS AND MAJOR KUDOS to the folks who created http://launchd.info for a great site on how launchd works!

The good news is that you can fix this with the workaround below. This is provided as a workaround, and not officially supported. Test on non-critical systems, etc. If you don't feel comfortable in a terminal window - you should probably not proceed.

Use the attached file and save it to: /Library/LaunchDaemons/com.splunk.bootstart.plist

Edit the file, note the file path, and change it as necessary. (Unless you're running Splunk in /opt/splunkforwarder like I do!)

The sample file is functional but doesn't show off any fancy launchd options, Splunk will run as user "root" unless you modify the .plist file by adding UserName key/value pairs. StdOut / StdErr are set to help troubleshoot, but may be removed if you don't want them.

Once the file is edited and saved, issue the following commands to set permissions and load the profile:

sudo chown root /Library/LaunchDaemons/com.splunk.bootstart.plist
sudo chmod644 /Library/LaunchDaemons/com.splunk.bootstart.plist
sudo launchctl load -w /Library/LaunchDaemons/com.splunk.bootstart.plist

If everything worked, splunk will start immediately when you run the command above. And at every reboot thereafter.

Happy Splunking!

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
    <dict>
       <key>Label</key>
       <string>com.splunk.bootstart</string>
       <key>ProgramArguments</key>
       <array>
          <string>/opt/splunkforwarder/bin/splunk</string>
          <string>start</string>
       </array>
       <key>RunAtLoad</key>
       <true />
       <key>StandardErrorPath</key>
       <string>/tmp/splunkboot.stderr</string>
       <key>StandardOutPath</key>
       <string>/tmp/splunkboot.stdout</string>
    </dict>
 </plist>

View solution in original post

beezwax
Engager

First of all, how come this isn't installed by default now?

Also, could someone fix that typo already mentioned on the second chmod command (add a space)?

Finally, the above does not work with version 7 since the path to splunk has changed, so here is an updated version:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
     <dict>
        <key>Label</key>
        <string>com.splunk.bootstart</string>
        <key>ProgramArguments</key>
        <array>
           <string>/opt/splunkforwarder/bin/splunk</string>
           <string>start</string>
        </array>
        <key>RunAtLoad</key>
        <true />
        <key>StandardErrorPath</key>
        <string>/tmp/splunkboot.stderr</string>
        <key>StandardOutPath</key>
        <string>/tmp/splunkboot.stdout</string>
     </dict>
  </plist>

mdonnelly_splun
Splunk Employee
Splunk Employee

In Splunk 6.2.1 (and older), the "enable boot-start" on the Mac relies on the StartupItems feature of OSX. The StartupItems feature was deprecated awhile back, OS X Yosemite removed support completely. With Yosemite, Apple relies on "launchd/launchctl" for process startup.

SERIOUS AND MAJOR KUDOS to the folks who created http://launchd.info for a great site on how launchd works!

The good news is that you can fix this with the workaround below. This is provided as a workaround, and not officially supported. Test on non-critical systems, etc. If you don't feel comfortable in a terminal window - you should probably not proceed.

Use the attached file and save it to: /Library/LaunchDaemons/com.splunk.bootstart.plist

Edit the file, note the file path, and change it as necessary. (Unless you're running Splunk in /opt/splunkforwarder like I do!)

The sample file is functional but doesn't show off any fancy launchd options, Splunk will run as user "root" unless you modify the .plist file by adding UserName key/value pairs. StdOut / StdErr are set to help troubleshoot, but may be removed if you don't want them.

Once the file is edited and saved, issue the following commands to set permissions and load the profile:

sudo chown root /Library/LaunchDaemons/com.splunk.bootstart.plist
sudo chmod644 /Library/LaunchDaemons/com.splunk.bootstart.plist
sudo launchctl load -w /Library/LaunchDaemons/com.splunk.bootstart.plist

If everything worked, splunk will start immediately when you run the command above. And at every reboot thereafter.

Happy Splunking!

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
    <dict>
       <key>Label</key>
       <string>com.splunk.bootstart</string>
       <key>ProgramArguments</key>
       <array>
          <string>/opt/splunkforwarder/bin/splunk</string>
          <string>start</string>
       </array>
       <key>RunAtLoad</key>
       <true />
       <key>StandardErrorPath</key>
       <string>/tmp/splunkboot.stderr</string>
       <key>StandardOutPath</key>
       <string>/tmp/splunkboot.stdout</string>
    </dict>
 </plist>

anthonysomerset
Path Finder

typo in your chmod command (missing a space) but works perfectly even with the DMG installed version if you modify the path to the splunk binary correctly - and confirmed working on el Capitan (10.11.x)

0 Karma

nickhills
Ultra Champion

This is a problem for me too on the UF.

If my comment helps, please give it a thumbs up!
0 Karma

firehaus
New Member

Thanks. This fix appears to be working.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...