All Apps and Add-ons

Why getting an SC4S errors with systemd unit file and Offline Container Installation?

lagoops
New Member

Hello,

I am trying to perform an offline container install of SC4S and keep getting the following error when trying to enable sc4s.service

[/usr/lib/systemd/system/sc4s.service:30] Trailing garbage, ignoring.
[/usr/lib/systemd/system/sc4s.service:31] Unknown lvalue '-e "SC4S_CONTAINER_HOST' in section 'Service'
[/usr/lib/systemd/system/sc4s.service:32] Missing '='.
[/usr/lib/systemd/system/sc4s.service:30] Trailing garbage, ignoring.
[/usr/lib/systemd/system/sc4s.service:31] Unknown lvalue '-e "SC4S_CONTAINER_HOST' in section 'Service'
[/usr/lib/systemd/system/sc4s.service:32] Missing '='.

This is the template I am using with modifications suggested in the offline installation guide:

[Unit]
Description=SC4S Container
Wants=NetworkManager.service network-online.target docker.service
After=NetworkManager.service network-online.target docker.service
Requires=docker.service

[Install]
WantedBy=multi-user.target

[Service]
Environment="SC4S_IMAGE=sc4slocal:latest"

# Required mount point for syslog-ng persist data (including disk buffer)
Environment="SC4S_PERSIST_MOUNT=splunk-sc4s-var:/var/lib/syslog-ng"

# Optional mount point for local overrides and configurations; see notes in docs
Environment="SC4S_LOCAL_MOUNT=/opt/sc4s/local:/etc/syslog-ng/conf.d/local:z"

# Optional mount point for local disk archive (EWMM output) files
Environment="SC4S_ARCHIVE_MOUNT=/opt/sc4s/archive:/var/lib/syslog-ng/archive:z"

# Map location of TLS custom TLS
Environment="SC4S_TLS_MOUNT=/opt/sc4s/tls:/etc/syslog-ng/tls:z"

TimeoutStartSec=0

ExecStartPre=/usr/bin/bash -c "/usr/bin/systemctl set-environment SC4SHOST=$(hostname -s)"

ExecStart=/usr/bin/docker run \
        -e "SC4S_CONTAINER_HOST=${SC4SHOST}" \
        -v "$SC4S_PERSIST_MOUNT" \
        -v "$SC4S_LOCAL_MOUNT" \
        -v "$SC4S_ARCHIVE_MOUNT" \
        -v "$SC4S_TLS_MOUNT" \
        --env-file=/opt/sc4s/env_file \
        --network host \
        --name SC4S \
        --rm $SC4S_IMAGE

Restart=on-abnormal

Any advice on what might be wrong with the service file?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...