I am trying to run splunk as a non-root user, but every time i start splunk I get the error "splunkd: error while loading shared libraries: libxslt.so.1: cannot open shared object file: No such file or directory"
I have created a user and group named "splunk" to run the server as. I have given it rights to read/write /opt/splunk. Even if I do:
$ sudo -u splunk bash bash$ source /opt/splunk/bin/setSplunkEnv bash$ /opt/splunk/bin/splunk start
I still get that error. As long as i set the $SPLUNK_HOME using setSplunkEnv, ldd correctly finds all the libraries on the system or in the /opt/splunk/lib/ directory.
It does work fine when I start it as root.
To make things more complicated, my sysadmins tell me that having /opt/splunk/lib in /etc/ld.so.conf breaks their Red Hat Network update stuff so they removed it. So, I tried the following before starting splunk:
which also results in ldd finding all the libraries, but I still get the error when starting splunkd.
$ sudo -u splunk bash bash$ export LD_LIBRARY_PATH=/opt/splunk/lib bash$ source /opt/splunk/bin/setSplunkEnv bash$ /opt/splunk/bin/splunk start
Splunk> All batbelt. No tights. Checking Prerequisites... Checking http port : open Checking mgmt port : open Checking configuration... Done. Checking index directory... Done. Checking databases... Validated databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sample, summary, test Checking for SELinux All Preliminary checks passed. splunkd: error while loading shared libraries: libxslt.so.1: cannot open shared object file: No such file or directory
You shouldn't need to do any of this stuff, much less mess with the system /etc/ld.so.conf. What I would do is:
tar -xf). It's possible that some files weren't extracted correctly.
There's not really very much more to it.
chown -R splunk:splunk was run on /opt/splunk and everything is owned by the running user. I'll have the sysadmins reinstall the rpm and see if that makes a difference
I had a sysadmin reinstall splunk and then upgrade it to 4.2 and it seems to be working fine, so I guess that must have been the issue. Thanks.