Installation

instal splunk soar, error can't read /etc/redhat-release

bambarita
Observer

does anyone ever know this issue,

I use centos8 stream to install soar 6.2.0 onprem,

but it can't read /etc/redhat-release

[phantom@10 splunk-soar]$ ./soar-prepare-system --splunk-soar-home /opt/splunk-soar/ --https-port 443
Detailed logs will be located at /opt/splunk-soar/var/log/phantom/phantom_install_log
Preparing system for installation of Splunk SOAR 6.2.0.355
Unable to read CentOS/RHEL version from /etc/redhat-release.
Traceback (most recent call last):
File "/opt/splunk-soar/./soar-prepare-system", line 93, in main
pre_installer.run()
File "/opt/splunk-soar/install/deployments/deployment.py", line 132, in run
self.run_pre_deploy()
File "/opt/splunk-soar/usr/python39/lib/python3.9/contextlib.py", line 79, in inner
return func(*args, **kwds)
File "/opt/splunk-soar/install/deployments/deployment.py", line 146, in run_pre_deploy
plan = DeploymentPlan.from_spec(self.spec, self.options)
File "/opt/splunk-soar/install/deployments/deployment_plan.py", line 51, in from_spec
deployment_operations=[_type(options) for _type in deployment_operations],
File "/opt/splunk-soar/install/deployments/deployment_plan.py", line 51, in <listcomp>
deployment_operations=[_type(options) for _type in deployment_operations],
File "/opt/splunk-soar/install/operations/optional_tasks/rpm_packages.py", line 53, in __init__
self.rpm_checker = RpmChecker(self.get_rpm_packages(), self.shell)
File "/opt/splunk-soar/install/operations/optional_tasks/rpm_packages.py", line 63, in get_rpm_packages
if get_os_family() == OsFamilyType.el7:
File "/opt/splunk-soar/install/install_common.py", line 340, in get_os_family
os_version = get_os_version()
File "/opt/splunk-soar/install/install_common.py", line 326, in get_os_version
return _get_centos_and_rhel_version()
File "/opt/splunk-soar/install/install_common.py", line 315, in _get_centos_and_rhel_version
raise InstallError("Unable to read CentOS/RHEL version from /etc/redhat-release.")
install.install_common.InstallError: Unable to read CentOS/RHEL version from /etc/redhat-release.
Pre-install failed.

 

while I open the /etc/redhat-release

[phantom@10 splunk-soar]$ cat /etc/redhat-release
NAME="CentOS stream"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Stream 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_SUPPORT_PRODUCT_VERSION="CentOS Stream"

 

welcome for any suggestion

Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
I’m not sure, but my expectation is that as Centos 8 isn’t supported (https://docs.splunk.com/Documentation/SOARonprem/6.2.0/Install/InstallUnprivileged), it cannot parse correctly content of this file.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...