We are having problems with upgrading Splunk forwarders on Solaris Sparc 10 hosts for vulnerability remediation. We were using 6.3.x and needed to update to a 6.5.x or later Splunk version. The errors are:
# ./splunk start
ld.so.1: splunkd: fatal: relocation error: file /opt/splunkforwarder/bin/splunkd: symbol pthread_condattr_setclock: referenced symbol not found
Killed
There's nothing logged other than the first_install.log which has the Splunk version and platform information: PLATFORM=SunOS-sparcv9
Where should we start to troubleshoot?
This is still a problem on Solaris, i have just upgraded the forwarder from 8.0.2 to 8.2.4 on solaris 11.3 with all pre-req suggested
Confirm that the Solaris system in question is on patch level SUNW_1.22.7 or later of the C library, which is required to install the latest versions of the Splunk Forwarder package on Solaris 10 Sparc. The pre-requisite is documented here.
Using the command sudo pvs /usr/lib/libc.so.1
you should see a list of patches. e.g.
> sudo pvs /usr/lib/libc.so.1
libdl.so.1 (SUNW_1.4, SUNWprivate_1.1);
libc.so.1;
SUNW_1.21.2;
SUNW_1.21.1;
SUNW_1.21;
SUNW_1.20.4;
SUNW_1.20.1;
SUNW_1.20;
SUNW_1.19;
SUNW_1.18.1;
SUNW_1.18;
SUNW_1.17;
SUNW_1.16;
SUNW_1.15;
The Solaris 10 Sparc hosts would have to be updated to SUNW_1.22.7 or later. Per the Oracle Support page that lists patches that include libc changes (Oracle Support required): https://support.oracle.com/rs?type=doc&id=2069855.1, the SUNW_1.22.7 is available in Patch 144500-19 for Solaris 10 Sparc.