The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Previous Topic: Date is off by 5 years for some hosts | Next Topic: Optimizing IO
Posts 1–10 of 13
I'm running RHEL4 Update 2. When I run the Splunk Server install binary from a terminal window (in GNOME) it returns immediately and there is nothing in any of my log files indicating a problem. I do see a Known Problem concerning potential graphical install problems. What I don't see anywhere is any documentation on installer command-line options (debugging, running non-graphical, etc.).
Can anyone point me in the right direction?
--Gary
Gary,
Try running the installer with "--mode text" and see if that works for you.
Thanks,
Brad
Brad,
Thanks for the pointer to --mode text, that was one of the things I was looking for. But it doesn't help. Is there an option for verbose debugging messages perhaps? More generally, are all the installer options documented somewhere? I also have an email from Vito indicating next week's new version might work better.
--Gary
Brad,
Does anything in the Splunk Server install utilize suid? Or, does the installation attempt to execute anything in the /tmp partition? I have some pretty restrictive mount options in effect on this machine (like noexec on /tmp, and nosuid on several partitions).
--Gary
It's possible that it uses /tmp -- it's a bitrock installer so I'm not sure what they do internally... You might want to try allowing it to muck with /tmp temporarily and then putting /tmp back to noexec.
Do you have strace on that machine? Try running strace <installer> and see if that produces any useful output.
I'll try the install after remounting /tmp, and if still necessary I'll run it through strace. But at this point I think I'll wait for the new release since it should be out in a few days with any luck. Might as well save myself a step. My evaluation of Splunk isn't (yet) time-critical.
Splunk installed fine in my case after I remounted /tmp as exec. The installer Splunk uses does indeed want to write a script to /tmp then execute it.
--Gary
Thanks for all the feedback from everyone; the 1.1.1 installer should not require tmp to be mounted with exec permissions.
Hello,
I seem to be having the same kind of problem, except there are no restrictive options for /tmp, it's a reiserfs mounted with 'defaults'. I have similar output when I run strace. The system is a fresh install of Debian Sarge AMD64. I'd appreciate any suggestions.
--Doug
[SOLVED]
There was a problem with the IA32 Libs. Splunk works fine now.
<p>
[Modified by: dwill (mankytongue) on January 12, 2006 01:19 PM]</p>
Solution for me AMD64 debian 2.6 kernel - was apt-get install ia32-libs
Splunk-lords - when I click on a search result for the forums I am frequently brought to the forum home page instead of the article requested.
Only the indexed bit seems to survive and the article can't be reached - I couldn't get to the article for this but guessed from the snippet displayed in the search results:
All Results
1. Splunk > Forums > SplunkGeneral > Linux install doesn't
... problem with the IA32 Libs. Splunk works fine now. <p ...
http://www.splunk.com/base/forum:SplunkGeneral/31
2. Splunk > Splunk 1.2.4 Install Problems
... so with apt-get install ia32-libs I am guessing in ...
http://www.splunk.com/index.php/xarbb/topic/188