Getting Data In

Getting error "Can't access "/etc/hostconfig": No such file or directory" How to enable universal forwarder on mac OSX to boot at startup?

pbalsley
Path Finder

I'm running Mac OSX 10.10 Yosemite. I have installed both the Universal Forwarder 6.1.4 and 6.2. Neither will enable start at boot. I get the following error.

Mac-mini:bin me$ sudo ./splunk enable boot-start
Password: *******
Can't access "/etc/hostconfig": No such file or directory

I have not seen any posts on how to fix this. Or what other method is to be used to have splunkforwarder start at boot time.

thanks

1 Solution

pbalsley
Path Finder

I'm going to answer my own question. OSX 10.10 no longer uses "/etc/hostconfig" nor the "/System/Library/Startupitems" system to start files which is what Splunk is trying to configure.

I was able to manually enable a startup file on OSX.

cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder
sudo chown root:wheel com.splunk.splunkforwarder
sudo chmod 644 com.splunk.splunkforwarder
sudo nano com.splunk.splunkforwarder.plist

========== Start File ===============

<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key> 
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
  <string>/Applications/SplunkForwarder/bin/splunk</string>
  <string>start</string>
  <string>--no-prompt</string>
  <string>--answer-yes</string>
</array>

========== End File ================

This will now start on boot.
You can manually start it now with:

sudo launchctl load -w /Library/LaunchDaemons/com.splunk.splunkforwarder.plist

View solution in original post

pbalsley
Path Finder

I'm going to answer my own question. OSX 10.10 no longer uses "/etc/hostconfig" nor the "/System/Library/Startupitems" system to start files which is what Splunk is trying to configure.

I was able to manually enable a startup file on OSX.

cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder
sudo chown root:wheel com.splunk.splunkforwarder
sudo chmod 644 com.splunk.splunkforwarder
sudo nano com.splunk.splunkforwarder.plist

========== Start File ===============

<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key> 
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
  <string>/Applications/SplunkForwarder/bin/splunk</string>
  <string>start</string>
  <string>--no-prompt</string>
  <string>--answer-yes</string>
</array>

========== End File ================

This will now start on boot.
You can manually start it now with:

sudo launchctl load -w /Library/LaunchDaemons/com.splunk.splunkforwarder.plist

netsentinel
Engager

Nice work - pbalsley

I would add a few corrections. When you touch the plist file above I had to add the ".plist" file extension to match the other Daemons being launched in this directory so the commands would be as follows:

cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder.plist
sudo chown root:wheel com.splunk.splunkforwarder.plist
sudo chmod 644 com.splunk.splunkforwarder.plist
sudo nano com.splunk.splunkforwarder.plist

Also add the xml plist tags to the file as such:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>KeepAlive</key>
    <false/>
    <key>Disabled</key>
    <false/>
    <key>RunAtLoad</key>
    <true/>
    <key>LaunchOnlyOnce</key>
    <true/>
    <key>Label</key>
    <string>com.splunk.splunkforwarder</string>
    <key>ProgramArguments</key>
    <array>
      <string>/Applications/SplunkForwarder/bin/splunk</string>
      <string>start</string>
      <string>--no-prompt</string>
      <string>--answer-yes</string>
    </array>
</dict>
</plist>

pbalsley
Path Finder

Ok very good. Thanks for making the file more accurate!

Now, let us just hope splunk updates their installer to do this for us. 🙂
pj

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...