Getting error "Can't access "/etc/hostconfig": No such file or directory" How to enable universal forwarder on mac OSX to boot at startup?

[pbalsley]

I'm running Mac OSX 10.10 Yosemite. I have installed both the Universal Forwarder 6.1.4 and 6.2. Neither will enable start at boot. I get the following error.

Mac-mini:bin me$ sudo ./splunk enable boot-start
Password: *******
Can't access "/etc/hostconfig": No such file or directory

I have not seen any posts on how to fix this. Or what other method is to be used to have splunkforwarder start at boot time.

thanks

[pbalsley · Accepted solution]

I'm going to answer my own question. OSX 10.10 no longer uses "/etc/hostconfig" nor the "/System/Library/Startupitems" system to start files which is what Splunk is trying to configure.

I was able to manually enable a startup file on OSX.

cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder
sudo chown root:wheel com.splunk.splunkforwarder
sudo chmod 644 com.splunk.splunkforwarder
sudo nano com.splunk.splunkforwarder.plist

========== Start File ===============

<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key> 
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
  <string>/Applications/SplunkForwarder/bin/splunk</string>
  <string>start</string>
  <string>--no-prompt</string>
  <string>--answer-yes</string>
</array>

========== End File ================

This will now start on boot.
You can manually start it now with:

sudo launchctl load -w /Library/LaunchDaemons/com.splunk.splunkforwarder.plist

[netsentinel]

Nice work - pbalsley

I would add a few corrections. When you touch the plist file above I had to add the ".plist" file extension to match the other Daemons being launched in this directory so the commands would be as follows:

cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder.plist
sudo chown root:wheel com.splunk.splunkforwarder.plist
sudo chmod 644 com.splunk.splunkforwarder.plist
sudo nano com.splunk.splunkforwarder.plist

Also add the xml plist tags to the file as such:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>KeepAlive</key>
    <false/>
    <key>Disabled</key>
    <false/>
    <key>RunAtLoad</key>
    <true/>
    <key>LaunchOnlyOnce</key>
    <true/>
    <key>Label</key>
    <string>com.splunk.splunkforwarder</string>
    <key>ProgramArguments</key>
    <array>
      <string>/Applications/SplunkForwarder/bin/splunk</string>
      <string>start</string>
      <string>--no-prompt</string>
      <string>--answer-yes</string>
    </array>
</dict>
</plist>

[pbalsley]

Ok very good. Thanks for making the file more accurate!

Now, let us just hope splunk updates their installer to do this for us. 🙂
pj