Installation

Splunk Universal Forwarder 7.3.6 SunOS sparc Won't Install - libstdc++.so.6 fatal error

gjlewis
Explorer

Hi,

We have an issue installing the Universal Forwarder software on Solaris 10 SPARC servers.

splunkforwarder-7.3.6-47d8552a4d84-SunOS-sparc.tar.Z

The following error occurs directly after accepting the license agreement and entering the Splunk admin username.

ld.so.1: splunkd: fatal: libstdc++.so.6: open failed: No such file or directory

OS info: SunOS 5.10 Generic_150400-65 sun4v sparc

The libc.so version is SUNW_1.23 (as per Splunk Docs: universal forwarders on a Sun SPARC system that runs Solaris need a patch level of SUNW_1.22.7 or later of the C library (libc.so.1)).

We have tried updating our LD_LIBRARY_PATH to include the location of the “missing” library.  libstdc++.so.6 is located in /usr/sfw/lib on our servers, so we ran:

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/sfw/lib

but it didn't work.

Any help or guidance would be appreciated.

Thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

xverdb
Engager

I was able to successfully install and get the Splunk 7.3.6 forwarder to start on Solaris 10 (Generic_150400-69) by copying the missing C++ library in /usr/sfw to the /opt/splunkforwarder library folder using the following procedures:

cp /usr/sfw/lib/sparc9/libstdc++.so.6.0.3 /opt/splunkforwarder/lib
cd /opt/splunkforwarder/lib
chmod 550 libstdc++.so.6.0.3
chown splunk:splunk libstdc++.so.6.0.3
ln -s libstdc++so.6.0.3 libstdc++.so.6

I suspect this would work on Solaris 11 as well.

View solution in original post

xverdb
Engager

I was able to successfully install and get the Splunk 7.3.6 forwarder to start on Solaris 10 (Generic_150400-69) by copying the missing C++ library in /usr/sfw to the /opt/splunkforwarder library folder using the following procedures:

cp /usr/sfw/lib/sparc9/libstdc++.so.6.0.3 /opt/splunkforwarder/lib
cd /opt/splunkforwarder/lib
chmod 550 libstdc++.so.6.0.3
chown splunk:splunk libstdc++.so.6.0.3
ln -s libstdc++so.6.0.3 libstdc++.so.6

I suspect this would work on Solaris 11 as well.

gjlewis
Explorer

UPDATE - I tried installing an older version of the installation software I had - 7.3.1.1 and it installed and Splunk started successfully.  So while I haven't figured out the issue, I do at least have a working forwarder on my Solaris 10 server.

I would still be interested to know if anyone knows why the older version works and the new one doesn't? According to the download page all versions of the UF software should work on Solaris 10 up to version 7.3.6.

FURTHER UPDATE - 7.3.5 also fails on start up with the same error, however 7.3.4.2 installs and starts up fine.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...