SplunkForwarder 8.1.0.1 Operation not permitted

User_6QRO2

Trying to install splunkforwarder and only on OL8 .... Centos is fine.

OL8 gives me errors such as Operation not permitted.

/opt/splunkforwarder/bin/splunk start --answer-yes --no-prompt --accept-license --seed-passwd ############
couldn't run "/opt/splunkforwarder/bin/splunkd" "btool": Operation not permitted
couldn't run "/opt/splunkforwarder/bin/splunkd" "btool": Operation not permitted
couldn't run "/opt/splunkforwarder/bin/splunkd" "btool": Operation not permitted
Did not find "disabled" setting of "kvstore" stanza in server bundle.

Splunk> Map. Reduce. Recycle.

Checking prerequisites...
couldn't run "/opt/splunkforwarder/bin/splunkd" "btool": Operation not permitted
  Checking mgmt port [8089]: couldn't run "/opt/splunkforwarder/bin/splunkd" "btool": Operation not permitted
open
execve: Operation not permitted
 while running command /opt/splunkforwarder/bin/splunkd
  Checking kvstore port [8191]: couldn't run "/opt/splunkforwarder/bin/splunkd" "btool": Operation not permitted
open
couldn't run "/opt/splunkforwarder/bin/splunkd" "btool": Operation not permitted
execve: Operation not permitted
 while running command /opt/splunkforwarder/bin/splunkd
SSL certificate generation failed.

OS info

[[email protected]#####bin]# cat /etc/os-release
NAME="Oracle Linux Server"
VERSION="8.3"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="8.3"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Oracle Linux Server 8.3"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:8:3:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://bugzilla.oracle.com/"

ORACLE_BUGZILLA_PRODUCT="Oracle Linux 8"
ORACLE_BUGZILLA_PRODUCT_VERSION=8.3
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=8.3

$uname -a

Linux aussvdevcv01 4.18.0-240.10.1.el8_3.x86_64 #1 SMP Mon Jan 4 12:04:12 PST 2021 x86_64 x86_64 x86_64 GNU/Linux

Selinux is off

permissions tripple checked

owner changes on source files to root:root.

Can't seem to understand the source of these Operation not permitted errors.

Avi Miller-Oracle

I have no idea but searching turned up these two possible solutions:

https://community.splunk.com/t5/Installation/Why-is-Splunk-not-starting-on-Linux-with-permission-denied/m-p/191768

https://community.splunk.com/t5/Installation/Why-is-Splunk-not-starting-on-Linux-with-permission-denied/m-p/191768

User_6QRO2

I've been down this rabbit hole but no dice.