Getting Data In
Highlighted

Getting error "Can't access "/etc/hostconfig": No such file or directory" How to enable universal forwarder on mac OSX to boot at startup?

Path Finder

I'm running Mac OSX 10.10 Yosemite. I have installed both the Universal Forwarder 6.1.4 and 6.2. Neither will enable start at boot. I get the following error.

Mac-mini:bin me$ sudo ./splunk enable boot-start
Password: *******
Can't access "/etc/hostconfig": No such file or directory

I have not seen any posts on how to fix this. Or what other method is to be used to have splunkforwarder start at boot time.

thanks

Highlighted

Re: Getting error "Can't access "/etc/hostconfig": No such file or directory" How to enable universal forwarder on mac OSX to boot at startup?

Path Finder

I'm going to answer my own question. OSX 10.10 no longer uses "/etc/hostconfig" nor the "/System/Library/Startupitems" system to start files which is what Splunk is trying to configure.

I was able to manually enable a startup file on OSX.

cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder
sudo chown root:wheel com.splunk.splunkforwarder
sudo chmod 644 com.splunk.splunkforwarder
sudo nano com.splunk.splunkforwarder.plist

========== Start File ===============

<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key> 
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
  <string>/Applications/SplunkForwarder/bin/splunk</string>
  <string>start</string>
  <string>--no-prompt</string>
  <string>--answer-yes</string>
</array>

========== End File ================

This will now start on boot.
You can manually start it now with:

sudo launchctl load -w /Library/LaunchDaemons/com.splunk.splunkforwarder.plist

View solution in original post

Highlighted

Re: Getting error "Can't access "/etc/hostconfig": No such file or directory" How to enable universal forwarder on mac OSX to boot at startup?

Engager

Nice work - pbalsley

I would add a few corrections. When you touch the plist file above I had to add the ".plist" file extension to match the other Daemons being launched in this directory so the commands would be as follows:

cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder.plist
sudo chown root:wheel com.splunk.splunkforwarder.plist
sudo chmod 644 com.splunk.splunkforwarder.plist
sudo nano com.splunk.splunkforwarder.plist

Also add the xml plist tags to the file as such:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>KeepAlive</key>
    <false/>
    <key>Disabled</key>
    <false/>
    <key>RunAtLoad</key>
    <true/>
    <key>LaunchOnlyOnce</key>
    <true/>
    <key>Label</key>
    <string>com.splunk.splunkforwarder</string>
    <key>ProgramArguments</key>
    <array>
      <string>/Applications/SplunkForwarder/bin/splunk</string>
      <string>start</string>
      <string>--no-prompt</string>
      <string>--answer-yes</string>
    </array>
</dict>
</plist>
Highlighted

Re: Getting error "Can't access "/etc/hostconfig": No such file or directory" How to enable universal forwarder on mac OSX to boot at startup?

Path Finder

Ok very good. Thanks for making the file more accurate!

Now, let us just hope splunk updates their installer to do this for us. 🙂
pj

0 Karma