Installation

Can you help us with the install errors we're recieving when trying to upgrade the universal forwarder on Solaris 10?

ekost
Splunk Employee
Splunk Employee

We are having problems with upgrading Splunk forwarders on Solaris Sparc 10 hosts for vulnerability remediation. We were using 6.3.x and needed to update to a 6.5.x or later Splunk version. The errors are:

# ./splunk start 
ld.so.1: splunkd: fatal: relocation error: file /opt/splunkforwarder/bin/splunkd: symbol pthread_condattr_setclock: referenced symbol not found 
Killed 

There's nothing logged other than the first_install.log which has the Splunk version and platform information: PLATFORM=SunOS-sparcv9

Where should we start to troubleshoot?

Labels (2)
0 Karma

ekost
Splunk Employee
Splunk Employee

Confirm that the Solaris system in question is on patch level SUNW_1.22.7 or later of the C library, which is required to install the latest versions of the Splunk Forwarder package on Solaris 10 Sparc. The pre-requisite is documented here.

Using the command sudo pvs /usr/lib/libc.so.1 you should see a list of patches. e.g.

> sudo pvs /usr/lib/libc.so.1 
libdl.so.1 (SUNW_1.4, SUNWprivate_1.1); 
libc.so.1; 
SUNW_1.21.2; 
SUNW_1.21.1; 
SUNW_1.21; 
SUNW_1.20.4; 
SUNW_1.20.1; 
SUNW_1.20; 
SUNW_1.19; 
SUNW_1.18.1; 
SUNW_1.18; 
SUNW_1.17; 
SUNW_1.16; 
SUNW_1.15; 

The Solaris 10 Sparc hosts would have to be updated to SUNW_1.22.7 or later. Per the Oracle Support page that lists patches that include libc changes (Oracle Support required): https://support.oracle.com/rs?type=doc&id=2069855.1, the SUNW_1.22.7 is available in Patch 144500-19 for Solaris 10 Sparc.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!