Splunk Enterprise

Anyone seeing 'libmongoc-1.0.0.dylib' errors when starting Splunk Light on OS X 10.11?


When I try starting Splunk Light on OS X 10.11, I see these errors several times:

dyld: Library not loaded: /Users/eserv/wrangler-2.0/build-home/ember/lib/libmongoc-1.0.0.dylib
  Referenced from: /Applications/Splunk/bin/splunkd
  Reason: image not found
Did not find "disabled" setting of "kvstore" stanza in server bundle.

Splunkd starts properly... are these errors going to affect any functionality?

Tags (3)


The splunk libraries for Mac have all been compiled with the wrong install names. When a library is compiled, the path to where that library will ultimately be found is coded into the library itself. So when a binary is compiled and links to that library it records where the library can be found at runtime from that setting. Each library has it's install name set when it's compiled and is usually set to where the library is compile to, in this case /Users/eserv/wrangler-2.0/build-home/ember/lib, but that's not where it ultimately ends up which is in /Applications/splunkforwarder/lib. So this new path needs to be explicitly set at compile time which is not done and so the binary ends up looking for the library in the wrong place. The reason why this works on 10.10 and below is that the splunkd process is launched by the splunk tool and the splunk tool first sets an environment variable (DYLD_LIBRARY_PATH) which tells the dynamic linker "hey look in this alternative location for any libraries". This environment variable get passed down to the splunkd subprocess when it's launched and so is able to find its libraries in that alternative location, namely "/Applications/splunkforwarder/lib". In 10.11 the ability for DYLD environment variable to be passed to subprocesses was blocked with the introduction of SIP (System Integrity Protection). So the splunkd process has only one place to look for those libraries "/Users/eserv/wrangler-2.0/build-home/ember/lib" which of course doesn't exist and the whole process crashes at that point. So splunk really just needs a recompile with the libraries having their correct install names.

Splunk Employee
Splunk Employee

In case anyone else is supporting an old version... You can work around the problem by following these directions: http://www.acme-dot.com/installing-splunk-on-el-capitan/

You may need to update the paths in the examples provided.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...