When starting Splunk 6.6.3 after upgrading to High Sierra, I was seeing the following errors:
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Traceback (most recent call last):
File "/Applications/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 17, in
import splunk.clilib.cli_common as comm
File "/Applications/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 10, in
from xml.sax import saxutils
File "/Applications/splunk/lib/python2.7/xml/sax/saxutils.py", line 6, in
import os, urlparse, urllib, types
File "/Applications/splunk/lib/python2.7/urllib.py", line 1440, in
from _scproxy import _get_proxy_settings, _get_proxies
ImportError: dlopen(/Applications/splunk/lib/python2.7/lib-dynload/_scproxy.so, 2): Symbol not found: _inflateValidate
Referenced from: /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
Expected in: /Applications/splunk/lib/libz.1.dylib
in /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
[This was after adding "OPTIMISTIC_ABOUT_FILE_LOCKING = 1" to the splunk-launch.conf to allow it to start on APFS.]
After some research, the 'fix' that seems to work was to copy over the (updated?) libz.1.dylib from /usr/lib as follows:
sudo rm /opt/splunk/lib/libz.1.dylib
sudo cp /usr/lib/libz.1.dylib /opt/splunk/lib/libz.1.dylib
This seems to allow Splunk to start now.
Note: This doesn't appear to be a problem with Splunk 7.0, just 6.6.x.
↧