Can you help us with the install errors we're recieving when trying to upgrade the universal forwarder on Solaris 10?

[ekost]

We are having problems with upgrading Splunk forwarders on Solaris Sparc 10 hosts for vulnerability remediation. We were using 6.3.x and needed to update to a 6.5.x or later Splunk version. The errors are:

# ./splunk start 
ld.so.1: splunkd: fatal: relocation error: file /opt/splunkforwarder/bin/splunkd: symbol pthread_condattr_setclock: referenced symbol not found 
Killed 

There's nothing logged other than the first_install.log which has the Splunk version and platform information: PLATFORM=SunOS-sparcv9

Where should we start to troubleshoot?

[setlhabetsik]

This is still a problem on Solaris, i have just upgraded the forwarder from 8.0.2 to 8.2.4 on solaris 11.3 with all pre-req suggested

[ekost]

Confirm that the Solaris system in question is on patch level SUNW_1.22.7 or later of the C library, which is required to install the latest versions of the Splunk Forwarder package on Solaris 10 Sparc. The pre-requisite is documented here.

Using the command sudo pvs /usr/lib/libc.so.1 you should see a list of patches. e.g.

> sudo pvs /usr/lib/libc.so.1 
libdl.so.1 (SUNW_1.4, SUNWprivate_1.1); 
libc.so.1; 
SUNW_1.21.2; 
SUNW_1.21.1; 
SUNW_1.21; 
SUNW_1.20.4; 
SUNW_1.20.1; 
SUNW_1.20; 
SUNW_1.19; 
SUNW_1.18.1; 
SUNW_1.18; 
SUNW_1.17; 
SUNW_1.16; 
SUNW_1.15; 

The Solaris 10 Sparc hosts would have to be updated to SUNW_1.22.7 or later. Per the Oracle Support page that lists patches that include libc changes (Oracle Support required): https://support.oracle.com/rs?type=doc&id=2069855.1, the SUNW_1.22.7 is available in Patch 144500-19 for Solaris 10 Sparc.