Universal Forwarder

[drggfish1]

I am getting a mismatch between the version of OPENSSL installed on my OS and in the Universal Forwarder. It seems to be keeping me from running the Universal Forwarder as a systemd process.

NAME="AlmaLinux"
VERSION="10.1 (Heliotrope Lion)"

[splunk@ip-172-31-34-212 bin]$ openssl version
OpenSSL 3.5.1 1 Jul 2025 (Library: OpenSSL 3.5.1 1 Jul 2025)

systemctl: /opt/splunkforwarder/lib/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by /usr/lib64/systemd/libsystemd-shared-257-13.el10.alma.1.so)

Thanks

[kml_uvce]

Rename/remove Splunk's OpenSSL libraries

cd /opt/splunkforwarder/lib
sudo mv libcrypto.so.3 libcrypto.so.3.bak
sudo mv libssl.so.3 libssl.so.3.bak

Then try starting the forwarder again:

sudo systemctl start SplunkForwarder

[PickleRick]

That will effectively cripple, if not completely break, the UF since it will have no openssl libraries to use.

[ITWhisperer]

openssl version shows which version is found by your shell.

Try bin/splunk cmd openssl version to find which version splunk is using.

[inventsekar · Accepted solution]

Hi @drggfish1 

Pls check this post:

https://splunk.my.site.com/customer/s/article/OPENSSL-3-4-0-not-found-warning-message-after-splunk-e...

Karma points appreciated, if this solves your issue, pls consider accepting it as solution, thanks..

[PickleRick]

We had a similar question not long ago...

What _exactly_ are you doing? UF ships with own openssl version which should be used within UF and only within UF. So systemctl trying to use openssl seems either like a bug or you are doing something wrong way.