All Apps and Add-ons

Why getting an SC4S errors with systemd unit file and Offline Container Installation?

lagoops
New Member

Hello,

I am trying to perform an offline container install of SC4S and keep getting the following error when trying to enable sc4s.service

[/usr/lib/systemd/system/sc4s.service:30] Trailing garbage, ignoring.
[/usr/lib/systemd/system/sc4s.service:31] Unknown lvalue '-e "SC4S_CONTAINER_HOST' in section 'Service'
[/usr/lib/systemd/system/sc4s.service:32] Missing '='.
[/usr/lib/systemd/system/sc4s.service:30] Trailing garbage, ignoring.
[/usr/lib/systemd/system/sc4s.service:31] Unknown lvalue '-e "SC4S_CONTAINER_HOST' in section 'Service'
[/usr/lib/systemd/system/sc4s.service:32] Missing '='.

This is the template I am using with modifications suggested in the offline installation guide:

[Unit]
Description=SC4S Container
Wants=NetworkManager.service network-online.target docker.service
After=NetworkManager.service network-online.target docker.service
Requires=docker.service

[Install]
WantedBy=multi-user.target

[Service]
Environment="SC4S_IMAGE=sc4slocal:latest"

# Required mount point for syslog-ng persist data (including disk buffer)
Environment="SC4S_PERSIST_MOUNT=splunk-sc4s-var:/var/lib/syslog-ng"

# Optional mount point for local overrides and configurations; see notes in docs
Environment="SC4S_LOCAL_MOUNT=/opt/sc4s/local:/etc/syslog-ng/conf.d/local:z"

# Optional mount point for local disk archive (EWMM output) files
Environment="SC4S_ARCHIVE_MOUNT=/opt/sc4s/archive:/var/lib/syslog-ng/archive:z"

# Map location of TLS custom TLS
Environment="SC4S_TLS_MOUNT=/opt/sc4s/tls:/etc/syslog-ng/tls:z"

TimeoutStartSec=0

ExecStartPre=/usr/bin/bash -c "/usr/bin/systemctl set-environment SC4SHOST=$(hostname -s)"

ExecStart=/usr/bin/docker run \
        -e "SC4S_CONTAINER_HOST=${SC4SHOST}" \
        -v "$SC4S_PERSIST_MOUNT" \
        -v "$SC4S_LOCAL_MOUNT" \
        -v "$SC4S_ARCHIVE_MOUNT" \
        -v "$SC4S_TLS_MOUNT" \
        --env-file=/opt/sc4s/env_file \
        --network host \
        --name SC4S \
        --rm $SC4S_IMAGE

Restart=on-abnormal

Any advice on what might be wrong with the service file?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...