Installation

Can you help us with the install errors we're recieving when trying to upgrade the universal forwarder on Solaris 10?

ekost
Splunk Employee
Splunk Employee

We are having problems with upgrading Splunk forwarders on Solaris Sparc 10 hosts for vulnerability remediation. We were using 6.3.x and needed to update to a 6.5.x or later Splunk version. The errors are:

# ./splunk start 
ld.so.1: splunkd: fatal: relocation error: file /opt/splunkforwarder/bin/splunkd: symbol pthread_condattr_setclock: referenced symbol not found 
Killed 

There's nothing logged other than the first_install.log which has the Splunk version and platform information: PLATFORM=SunOS-sparcv9

Where should we start to troubleshoot?

Labels (2)
0 Karma

setlhabetsik
New Member

This is still a problem on Solaris, i have just upgraded the forwarder from 8.0.2 to 8.2.4 on solaris 11.3 with all pre-req suggested

0 Karma

ekost
Splunk Employee
Splunk Employee

Confirm that the Solaris system in question is on patch level SUNW_1.22.7 or later of the C library, which is required to install the latest versions of the Splunk Forwarder package on Solaris 10 Sparc. The pre-requisite is documented here.

Using the command sudo pvs /usr/lib/libc.so.1 you should see a list of patches. e.g.

> sudo pvs /usr/lib/libc.so.1 
libdl.so.1 (SUNW_1.4, SUNWprivate_1.1); 
libc.so.1; 
SUNW_1.21.2; 
SUNW_1.21.1; 
SUNW_1.21; 
SUNW_1.20.4; 
SUNW_1.20.1; 
SUNW_1.20; 
SUNW_1.19; 
SUNW_1.18.1; 
SUNW_1.18; 
SUNW_1.17; 
SUNW_1.16; 
SUNW_1.15; 

The Solaris 10 Sparc hosts would have to be updated to SUNW_1.22.7 or later. Per the Oracle Support page that lists patches that include libc changes (Oracle Support required): https://support.oracle.com/rs?type=doc&id=2069855.1, the SUNW_1.22.7 is available in Patch 144500-19 for Solaris 10 Sparc.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...