Getting Data In

Forwarder Install via RPM: Failed Dependencies

jchensor
Communicator

I'm currently trying to install a Splunk Forwarder onto a 64-bit CentOS box via RPM. I'm logged into the machine as a user but "sudo -i" myself to root. When I then try to install the Splunk Forwarder by executing:

rpm -i splunkforwarder-4.3-115073.i386.rpm

...the install fails and I get the following message:

error: Failed dependencies:
    /bin/uname is needed by splunkforwarder-4.3-115073.i386.rpm
    /bin/mv is needed by splunkforwarder-4.3-115073.i386.rpm
    /bin/sh is needed by splunkforwarder-4.3-115073.i386.rpm

All of these are on the machine already. And I know I've run into this issue long before, and I can't remember what I did to resolve it anymore. Anyone know, offhand, what may be causing this error? Does it have to do with becoming root through "sudo -i" as opposed to logging in directly as root?

Thanks.

  • James
0 Karma
1 Solution

jchensor
Communicator

Repeating what I said in my comment to echalex, it did turn out to NOT be a Splunk problem. rpm can just be screwy and, depending on how the machine is set up, might not "know" if things like uname and mv and such are actually installed.

So I used the "--nodeps" option when running rpm after confirming everything was there, and it all went through just fine and is working well now.

So again, not a Splunk problem, actually an rpm problem.

  • James

View solution in original post

rzoch
New Member

FYI

If you try to install the splunkforwarder repo rpm via dnf in Fedora 30, the installation will fail since the splunkforwarder package is not specifically looking for coreutils (i.e., bin, uname).

$ dnf install splunkforwarder-7.2.1
Last metadata expiration check: 0:20:59 ago on Mon 13 May 2019 03:23:11 PM CDT.
Error: Problem: conflicting requests
- nothing provides /bin/mv needed by splunkforwarder-7.2.1-be11b2c46e23.x86_64
- nothing provides /bin/uname needed by splunkforwarder-7.2.1-be11b2c46e23.x86_64
(try to add '--skip-broken' to skip uninstallable packages)

...

$ dnf provides '*/uname'
Last metadata expiration check: 0:32:15 ago on Mon 13 May 2019 03:23:11 PM CDT.
coreutils-8.31-2.fc30.x86_64 : A set of basic GNU tools commonly used in shell scripts
Repo : @System
Matched from:
Filename : /usr/bin/uname
...
$ uname -a
Linux splunkhost 5.0.13-300.fc30.x86_64 #1 SMP Mon May 6 00:39:45 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

0 Karma

rzoch
New Member

Well that was quick! The latest rpm (splunkforwarder-7.2.6-c0bf0f679ce9) installs via dnf in Fedora 30 without any issues.

0 Karma

jchensor
Communicator

Repeating what I said in my comment to echalex, it did turn out to NOT be a Splunk problem. rpm can just be screwy and, depending on how the machine is set up, might not "know" if things like uname and mv and such are actually installed.

So I used the "--nodeps" option when running rpm after confirming everything was there, and it all went through just fine and is working well now.

So again, not a Splunk problem, actually an rpm problem.

  • James

echalex
Builder

Oops! I notice that you specify you're using a 64-bit CentOS, but you're trying to install the 32-bit Splunk. I recommend you try downloading the 64-bit Splunk RPM instead.

That being said, I still think that rpm should know about those binaries being installed. Perhaps you could try installing using --nodeps, but I don't think that's recommended. Using the tarball may be your best bet.

Since CentOS is reportedly almost identical to RHEL, I think it should have at least mv and uname as parts of the coreutils package. Perhaps you could check for that package:

rpm -ql coreutils |egrep '(uname|mv)'

If you can't see /bin/mv or /bin/uname, perhaps you should check whether using yum or rpm would help you.

Which version of CentOS are you using?

0 Karma

jchensor
Communicator

Hi, echalex!

Thanks for the response. I looked deeper into it and, yeah, this turns out to NOT be a Splunk problem. RPM can just be screwy and, depending on how the machine is set up, might not "know" if things like uname and mv and such are actually installed.

So I actually did use the "--nodeps" option and it worked just fine. So it's installed properly and working great now!

And yes, I noticed as well I was using the wrong installer. ^_^ That didn't solve the dependency problem, but still was probably a good idea to fix that as well. Hehehe.

Thanks for your help, echalex!

  • James
0 Karma

echalex
Builder

jchensor,
I don't think the "sudo -i" should affect that, but you could try using "sudo -s" instead, or just doing the entire install command with sudo:

sudo rpm -Uvh splunkforwarder-4.3-115073.i386.rpm

If This doesn't work, you may want to check that those binaries are actually installed by an RPM package. (Not that I see why they wouldn't.)

rpm -qf /bin/uname
rpm -qf /bin/mv
rpm -qf /bin/sh

The commands uname and mv should be installed by coreutils (at least on RHEL) and sh should be installed by bash.
HTH

0 Karma

jchensor
Communicator

Hmm, I get the same error with sudo -s and just trying to sudo from my account that I'm logged in on.

When I run the rpm -qf on the three items, it tells me that they are not owned by any package. I'm not the best when it comes to Linux, so does that mean I need to do something to them to make them a part of an RPM package?

  • James
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...