It's a bug in the locktest binary. It doesn't actually test locking at all; it just has a whitelist of known filesystems, and if your fs isn't in that list, it fails. Two workarounds:
Use a binary editor on the locktest binary and replace one of the filesystems in the list ("nfs" for example) with "zfs".
Use LD_PRELOAD to pull in a shared object that wraps the fsstat() syscall and replaces "zfs" with "ufs". Luckily I created one to work around a similar bug in Symantec Netbackup 🙂 If you build the shared object from this post, all you need to do is add
export LD_PRELOAD=/usr/local/lib/fakegetfsstat.so
to your startup script, and splunk should work fine.
... View more