I'm running Mac OSX 10.10 Yosemite. I have installed both the Universal Forwarder 6.1.4 and 6.2. Neither will enable start at boot. I get the following error.
Mac-mini:bin me$ sudo ./splunk enable boot-start
Password: *******
Can't access "/etc/hostconfig": No such file or directory
I have not seen any posts on how to fix this. Or what other method is to be used to have splunkforwarder start at boot time.
thanks
I'm going to answer my own question. OSX 10.10 no longer uses "/etc/hostconfig" nor the "/System/Library/Startupitems" system to start files which is what Splunk is trying to configure.
I was able to manually enable a startup file on OSX.
cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder
sudo chown root:wheel com.splunk.splunkforwarder
sudo chmod 644 com.splunk.splunkforwarder
sudo nano com.splunk.splunkforwarder.plist
========== Start File ===============
<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key>
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/SplunkForwarder/bin/splunk</string>
<string>start</string>
<string>--no-prompt</string>
<string>--answer-yes</string>
</array>
========== End File ================
This will now start on boot.
You can manually start it now with:
sudo launchctl load -w /Library/LaunchDaemons/com.splunk.splunkforwarder.plist
I'm going to answer my own question. OSX 10.10 no longer uses "/etc/hostconfig" nor the "/System/Library/Startupitems" system to start files which is what Splunk is trying to configure.
I was able to manually enable a startup file on OSX.
cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder
sudo chown root:wheel com.splunk.splunkforwarder
sudo chmod 644 com.splunk.splunkforwarder
sudo nano com.splunk.splunkforwarder.plist
========== Start File ===============
<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key>
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/SplunkForwarder/bin/splunk</string>
<string>start</string>
<string>--no-prompt</string>
<string>--answer-yes</string>
</array>
========== End File ================
This will now start on boot.
You can manually start it now with:
sudo launchctl load -w /Library/LaunchDaemons/com.splunk.splunkforwarder.plist
Nice work - pbalsley
I would add a few corrections. When you touch the plist file above I had to add the ".plist" file extension to match the other Daemons being launched in this directory so the commands would be as follows:
cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder.plist
sudo chown root:wheel com.splunk.splunkforwarder.plist
sudo chmod 644 com.splunk.splunkforwarder.plist
sudo nano com.splunk.splunkforwarder.plist
Also add the xml plist tags to the file as such:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key>
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/SplunkForwarder/bin/splunk</string>
<string>start</string>
<string>--no-prompt</string>
<string>--answer-yes</string>
</array>
</dict>
</plist>
Ok very good. Thanks for making the file more accurate!
Now, let us just hope splunk updates their installer to do this for us. 🙂
pj