Installation

splunk ARM won't install on BeagleBone Black

iben
Engager

root@beaglebone:/opt/splunkforwarder/bin# ./splunk start
/opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre.so.1: cannot open shared object file: No such file or directory

The new BBB runs Debian GNU/Linux 7
beaglebone 3.8.13-bone47 #1 SMP Fri Apr 11 01:36:09 UTC 2014 armv7l

0 Karma

jensihnow
Path Finder

Same problem here but libarchive.so.13

Splunk rev.  9.11.2013
Do you agree with this license? [y/n]: y
This appears to be your first time running this version of Splunk.
/opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libarchive.so.13: cannot open shared object file: No such file or directory
/opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libarchive.so.13: cannot open shared object file: No such file or directory
Splunk> Map. Reduce. Recycle.
Checking prerequisites...
/opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libarchive.so.13: cannot open shared object file: No such file or directory
        Checking mgmt port [8089]: /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libarchive.so.13: cannot open shared object file: No such file or directory
Illegal instruction

I tried to modify the library paths but didn't helped out so far:

/opt/splunkforwarder/bin# ./splunk cmd $(which env) | grep -i splunk
OLDPWD=/opt/splunkforwarder/lib
PATH=/opt/splunkforwarder/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/opt/splunkforwarder/bin
_=./splunk
SPLUNK_HOME=/opt/splunkforwarder
SPLUNK_DB=/opt/splunkforwarder/var/lib/splunk
SPLUNK_SERVER_NAME=splunkforwarder
SPLUNK_WEB_NAME=splunkweb
LD_LIBRARY_PATH=/opt/splunkforwarder/lib
OPENSSL_CONF=/opt/splunkforwarder/openssl/openssl.cnf
LDAPCONF=/opt/splunkforwarder/etc/openldap/ldap.conf

Lib content:

/opt/splunkforwarder/bin# ls -l /opt/splunkforwarder/lib/*
-r--r--r-- 1 root root      57 Sep 27  2013 /opt/splunkforwarder/lib/copyright.txt
lrwxrwxrwx 1 root root      20 Sep 27  2013 /opt/splunkforwarder/lib/libarchive.so -> libarchive.so.13.1.2
lrwxrwxrwx 1 root root      20 Sep 27  2013 /opt/splunkforwarder/lib/libarchive.so.13 -> libarchive.so.13.1.2
-r-xr-xr-x 1 root root  511016 Sep 28  2013 /opt/splunkforwarder/lib/libarchive.so.13.1.2
lrwxrwxrwx 1 root root      15 Sep 27  2013 /opt/splunkforwarder/lib/libbz2.so -> libbz2.so.1.0.3
lrwxrwxrwx 1 root root      15 Sep 27  2013 /opt/splunkforwarder/lib/libbz2.so.1 -> libbz2.so.1.0.3
-r-xr-xr-x 1 root root   71020 Sep 28  2013 /opt/splunkforwarder/lib/libbz2.so.1.0.3
lrwxrwxrwx 1 root root      18 Sep 27  2013 /opt/splunkforwarder/lib/libcrypto.so -> libcrypto.so.1.0.0
-r-xr-xr-x 1 root root 1476588 Sep 28  2013 /opt/splunkforwarder/lib/libcrypto.so.1.0.0
lrwxrwxrwx 1 root root      18 Sep 27  2013 /opt/splunkforwarder/lib/libexslt.so -> libexslt.so.0.8.17
lrwxrwxrwx 1 root root      18 Sep 27  2013 /opt/splunkforwarder/lib/libexslt.so.0 -> libexslt.so.0.8.17
-r-xr-xr-x 1 root root   97796 Sep 28  2013 /opt/splunkforwarder/lib/libexslt.so.0.8.17
lrwxrwxrwx 1 root root      16 Sep 27  2013 /opt/splunkforwarder/lib/libpcre.so -> libpcre.so.1.2.1
lrwxrwxrwx 1 root root      16 Sep 27  2013 /opt/splunkforwarder/lib/libpcre.so.1 -> libpcre.so.1.2.1
-r-xr-xr-x 1 root root  244172 Sep 28  2013 /opt/splunkforwarder/lib/libpcre.so.1.2.1
lrwxrwxrwx 1 root root      19 Sep 27  2013 /opt/splunkforwarder/lib/libsqlite3.so -> libsqlite3.so.0.8.6
lrwxrwxrwx 1 root root      19 Sep 27  2013 /opt/splunkforwarder/lib/libsqlite3.so.0 -> libsqlite3.so.0.8.6
-r-xr-xr-x 1 root root  575376 Sep 28  2013 /opt/splunkforwarder/lib/libsqlite3.so.0.8.6
lrwxrwxrwx 1 root root      15 Sep 27  2013 /opt/splunkforwarder/lib/libssl.so -> libssl.so.1.0.0
-r-xr-xr-x 1 root root  336464 Sep 28  2013 /opt/splunkforwarder/lib/libssl.so.1.0.0
lrwxrwxrwx 1 root root      16 Sep 27  2013 /opt/splunkforwarder/lib/libxml2.so -> libxml2.so.2.9.1
lrwxrwxrwx 1 root root      16 Sep 27  2013 /opt/splunkforwarder/lib/libxml2.so.2 -> libxml2.so.2.9.1
-r-xr-xr-x 1 root root 1832152 Sep 28  2013 /opt/splunkforwarder/lib/libxml2.so.2.9.1
lrwxrwxrwx 1 root root      17 Sep 27  2013 /opt/splunkforwarder/lib/libxslt.so -> libxslt.so.1.1.28
lrwxrwxrwx 1 root root      17 Sep 27  2013 /opt/splunkforwarder/lib/libxslt.so.1 -> libxslt.so.1.1.28
-r-xr-xr-x 1 root root  323324 Sep 28  2013 /opt/splunkforwarder/lib/libxslt.so.1.1.28
lrwxrwxrwx 1 root root      13 Sep 27  2013 /opt/splunkforwarder/lib/libz.so -> libz.so.1.2.8
lrwxrwxrwx 1 root root      13 Sep 27  2013 /opt/splunkforwarder/lib/libz.so.1 -> libz.so.1.2.8
-r-xr-xr-x 1 root root   94648 Sep 28  2013 /opt/splunkforwarder/lib/libz.so.1.2.8

/opt/splunkforwarder/lib/engines:
total 232
-r-xr-xr-x 1 root root 14680 Sep 28  2013 lib4758cca.so
-r-xr-xr-x 1 root root 14784 Sep 28  2013 libaep.so
-r-xr-xr-x 1 root root 10616 Sep 28  2013 libatalla.so
-r-xr-xr-x 1 root root  3300 Sep 28  2013 libcapi.so
-r-xr-xr-x 1 root root 19116 Sep 28  2013 libchil.so
-r-xr-xr-x 1 root root 17564 Sep 28  2013 libcswift.so
-r-xr-xr-x 1 root root  3300 Sep 28  2013 libgmp.so
-r-xr-xr-x 1 root root 83336 Sep 28  2013 libgost.so
-r-xr-xr-x 1 root root  9080 Sep 28  2013 libnuron.so
-r-xr-xr-x 1 root root  3304 Sep 28  2013 libpadlock.so
-r-xr-xr-x 1 root root 18916 Sep 28  2013 libsureware.so
-r-xr-xr-x 1 root root 14776 Sep 28  2013 libubsec.so

ldd:

./splunk cmd $(which ldd) /opt/splunkforwarder/bin/splunkd
        not a dynamic executable

I poked around a lot worked as root (as you see), changed paths and so on. Nothing worked, unfortunately the packages isn't very helpful right now. Only if you ron on a Rasperry ... I'm running debian on another ARM platform:

cat /proc/version
Linux version 2.6.32-5-kirkwood (Debian 2.6.32-48squeeze1) (dannf@debian.org) (gcc version 4.3.5 (Debian 4.3.5-4) ) #1 Mon Feb 25 13:55:40 UTC 2013
0 Karma

ephemeric
Contributor

I also get "not a dynamic executable".

  • Linux version 3.14.33-ipfire-pae (root@helena.ipfire.org) (gcc version 4.4.7 (GCC) ) #1 SMP Fri Feb 20 17:37:46 GMT 2015
  • Linux proxy 3.14.33-ipfire-pae #1 SMP Fri Feb 20 17:37:46 GMT 2015 i686 GNU/Linux---
  • splunkforwarder-6.2.2-255606-linux-2.6-i386-manifest
0 Karma

jrodman
Splunk Employee
Splunk Employee

We should have very little care about the distribution; we try to depend only on libc. Please try:

splunk cmd $(which env) | grep -i splunk

and

ls -l /opt/splunkforwarder/lib/*pcre*

and

splunk cmd $(which ldd) /opt/splunkforwarder/bin/splunkd
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...