Why am I getting error "locale::facet::_S_create_c_locale name not valid" deploying the Splunk App for Stream on RHEL universal forwarders?

[bizza]

Hi, I have some troubles deploying Splunk_TA_stream on universal forwarders.
Indexer using the same TA works fine, and I was able to get stream data.
Once I put the TA in the deployment server, and client correctly download and install it, just after the splunkforwarder deamon restart I found this in the logs:

06-12-2015 15:34:34.623 +0200 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwd" terminate called after throwing an instance of 'std::runtime_error'
06-12-2015 15:34:34.623 +0200 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwd"   what():  locale::facet::_S_create_c_locale name not valid

Splunk run as a root, I tried chown'ing files and binaries to splunk:splunk, but the issue persist.

Operating system is RHEL 6.6 x86_64, SELinux disabled.

I had the same issue on the indexer on my first installation, and I solved it just deploying the app using the web interface uploader, and upgrading RHEL (yum update -y), but I don't know if this is related.

Any hints?

Ciao
Marco

[mdickey_splunk]

Are you using a non-English version of RHEL? The exact cause is difficult to determine, but my suspicion is that certain RHEL distros failed to include a properly configured (standard) "C" locale and this problem was fixed in a later release.

[bizza]

English version, I used localedef to force C and UTF8 before trying the upgrade.
I still don't know what was the issue and this make me a little uncomfortable...
RHEL7 works at the first try.
strace wasn't helpful to find the root cause and ldd show me that shared libraries was linked correctly, so I think this is just a bug.

[bizza]

Upgrading RHEL and rebooting solve the issue, but I'd like to understand the error.