Splunk Enterprise

Anyone seeing 'libmongoc-1.0.0.dylib' errors when starting Splunk Light on OS X 10.11?

dcarmich
Engager

When I try starting Splunk Light on OS X 10.11, I see these errors several times:

dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
  Referenced from: /Applications/Splunk/bin/splunkd
  Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.

Splunkd starts properly... are these errors going to affect any functionality?

Tags (3)

jonboy1000
Engager

The splunk libraries for Mac have all been compiled with the wrong install names. When a library is compiled, the path to where that library will ultimately be found is coded into the library itself. So when a binary is compiled and links to that library it records where the library can be found at runtime from that setting. Each library has it's install name set when it's compiled and is usually set to where the library is compile to, in this case /Users/eserv/wrangler-2.0/build-home/ember/lib, but that's not where it ultimately ends up which is in /Applications/splunkforwarder/lib. So this new path needs to be explicitly set at compile time which is not done and so the binary ends up looking for the library in the wrong place. The reason why this works on 10.10 and below is that the splunkd process is launched by the splunk tool and the splunk tool first sets an environment variable (DYLD_LIBRARY_PATH) which tells the dynamic linker "hey look in this alternative location for any libraries". This environment variable get passed down to the splunkd subprocess when it's launched and so is able to find its libraries in that alternative location, namely "/Applications/splunkforwarder/lib". In 10.11 the ability for DYLD environment variable to be passed to subprocesses was blocked with the introduction of SIP (System Integrity Protection). So the splunkd process has only one place to look for those libraries "/Users/eserv/wrangler-2.0/build-home/ember/lib" which of course doesn't exist and the whole process crashes at that point. So splunk really just needs a recompile with the libraries having their correct install names.

bnorthway_splun
Splunk Employee
Splunk Employee

In case anyone else is supporting an old version... You can work around the problem by following these directions: http://www.acme-dot.com/installing-splunk-on-el-capitan/

You may need to update the paths in the examples provided.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...