`OPENSSL_3.4.0' not found warning message seen after upgrade to RHEL 9.7

Applicability

Description

After upgrading to RHEL 9.7, managing service or enabling boot start would result to below warning message:

/opt/splunkforwarder/bin/splunk enable boot-start        
/bin/systemctl: /opt/splunkforwarder/lib/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by /usr/lib64/systemd/libsystemd-shared-252.so)/opt/splunkforwarder/bin/splunk enable boot-start -systemd-managed 1
/bin/systemctl: /opt/splunkforwarder/lib/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by /usr/lib64/systemd/libsystemd-shared-252.so)/opt/splunkforwarder/bin/splunk start
Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R splunkfwd:splunkfwd /opt/splunkforwarder"
/bin/systemctl: /opt/splunkforwarder/lib/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by /usr/lib64/systemd/libsystemd-shared-252.so)

Investigation

• This is a known issue, and internal teams are working in releasing the fix in the next patch. 
• Impacted versions:
  

  9.0.x
  9.1.x
  9.2.x
  9.3.x
  9.4.x
  10.0.x
  10.2.x

• There have been no reports of any other impact other than the warning shown during service start. 
• If there's any other impact other than the warning message, it's necessary to collect additional artifacts to demonstrate this.

Resolution

Steps to verify that Splunk service still runs even with the seen warning message:

If using init.d:

1. Verify that chkconfig is enabled.

Ways to install:

dnf install chkconfig

yum install chkcofig

Note: There was an issue with enabling boot start if chkconfig was not installed, see KB 000010501.

Reference: https://splunk.my.site.com/customer/s/article/Unable-to-configure-the-Splunk-boot-start

      2. Enable boot-start for the Splunk process.

Go to $SPLUNK_HOME and run 'splunk enable boot-start user splunk'

This would still show the warning message.

      3. systemctl daemon-reload

      4. systemctl start SplunkForwarder

      5. systemctl status SplunkForwarder

      6. ps -ef | grep splunk

If using systemd:

1. Go to $SPLUNK_HOME and run 'splunk enable boot-start -systemd-managed 1'

The warning is expected.

      2. systemctl start SplunkForwarder

      3. systemctl status SplunkForwarder

      4. ps -ef | grep splunk

Above steps are ways to verify that the Splunk service starts.

Reference:
splunk-enterprise-to-start-at-boot-time

The issue has been fixed in version 9.3.10, 9.4.9, 10.0.4 and 10.2.1

Related Links

Splunk Enterprise 10.2.1 fixed issues | Platform