rpm upgrade not working...


I inherited a Splunk server that I'm trying to do an upgrade on, but the rpm keeps hanging.

rpm -Uvh splunk-6.1........

and when it tries to upgrade it hangs at:

This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server...

The server is hardened with DOD STIG, so maybe that is the issue? Which logs would I look at to get some answers?

Running RHEL 6.8

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This is likely related to user permissions.
Which user is Splunk running as?
Which user are you running the rpm upgrade as?
Also, check init script for Splunk be it init /etc/init.d/splunk or systemd e.g. /etc/systemd/system/splunk.service

0 Karma


Splunk is running as 'splunk'

The rpm upgrade is running as 'root'

What should I look for in /etc/init.d/splunk?

A side note on this: the server was running Splunk as 'root' when I first looked at it. I changed the permissions so that the user 'splunk' would run it instead.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!