We are having problems with upgrading Splunk forwarders on Solaris Sparc 10 hosts for vulnerability remediation. We were using 6.3.x and needed to update to a 6.5.x or later Splunk version. The errors are:
# ./splunk start ld.so.1: splunkd: fatal: relocation error: file /opt/splunkforwarder/bin/splunkd: symbol pthread_condattr_setclock: referenced symbol not found Killed
There's nothing logged other than the first_install.log which has the Splunk version and platform information:
Where should we start to troubleshoot?
This is still a problem on Solaris, i have just upgraded the forwarder from 8.0.2 to 8.2.4 on solaris 11.3 with all pre-req suggested
Confirm that the Solaris system in question is on patch level SUNW_1.22.7 or later of the C library, which is required to install the latest versions of the Splunk Forwarder package on Solaris 10 Sparc. The pre-requisite is documented here.
Using the command
sudo pvs /usr/lib/libc.so.1 you should see a list of patches. e.g.
> sudo pvs /usr/lib/libc.so.1 libdl.so.1 (SUNW_1.4, SUNWprivate_1.1); libc.so.1; SUNW_1.21.2; SUNW_1.21.1; SUNW_1.21; SUNW_1.20.4; SUNW_1.20.1; SUNW_1.20; SUNW_1.19; SUNW_1.18.1; SUNW_1.18; SUNW_1.17; SUNW_1.16; SUNW_1.15;
The Solaris 10 Sparc hosts would have to be updated to SUNW_1.22.7 or later. Per the Oracle Support page that lists patches that include libc changes (Oracle Support required): https://support.oracle.com/rs?type=doc&id=2069855.1, the SUNW_1.22.7 is available in Patch 144500-19 for Solaris 10 Sparc.