Knowledge Management

Error installing Splunk 9.3 on RHEL 8 server

jmrubio
Path Finder

Hello!

I am trying to upgrade to the latest version of Splunk Enterprise 9.3 on a RHEL 8 server, but I am getting this error message after accepting the license. Any one seen this error? I have checked the permissions, and they are all fine. Thanks!

Fatal Python error: init_fs_encoding: failed to get the Python codec of the filesystem encoding
Python runtime state: core initialized
Traceback (most recent call last):
File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 846, in exec_module
File "<frozen importlib._bootstrap_external>", line 982, in get_code
File "<frozen importlib._bootstrap_external>", line 1039, in get_data
PermissionError: [Errno 1] Operation not permitted: '/opt/splunk/lib/python3.9/encodings/__init__.py'

Labels (1)
0 Karma
1 Solution

jmrubio
Path Finder

So this issue was being caused by an fapolicyd deny all rule. Once I moved the rule out of the /etc/fapolicyd/rules.d, it let me upgrade Splunk.

View solution in original post

0 Karma

jmrubio
Path Finder

So this issue was being caused by an fapolicyd deny all rule. Once I moved the rule out of the /etc/fapolicyd/rules.d, it let me upgrade Splunk.

0 Karma

marnall
Motivator

Could you try running it once with sudo? This should allow you to accept the license agreement, and then Splunk will use system privileges to set up the systemd service. Afterwards it should be controllable with systemctl.

0 Karma
Get Updates on the Splunk Community!

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...