Upgrading Java from Version 8 to 11 for Splunk DB Connect and Validating Unused JRE/JDK Directories

Applicability

Description

Splunk DB Connect is configured to use OpenJDK 1.8.0_342, with the JRE path set under the application settings to /usr/lib/jvm/jre-1.8.0-openjdk. A second directory, /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.342.b07-1.el7_9.x86_64/, is present in the same location.

The RPM database shows no record of any Java package (rpm -qa | grep -i java returns no Java entries), indicating both directories were manually extracted rather than installed via a package manager. The Java 8 build is affected by a critical OpenJDK vulnerability and must be upgraded.

Two requirements are addressed:

• Upgrade Java to a supported version.
• Determine whether the second directory is in use and safe to remove.

Investigation

Confirm the active Java version, identify the path used by Splunk DB Connect, and determine whether the configured JRE directory is a symlink into the full JDK directory before removing anything.

./java -version
ls -la /usr/lib/jvm/jre-1.8.0-openjdk
readlink -f /usr/lib/jvm/jre-1.8.0-openjdk
cat /opt/splunk_app_db_connect_3.8/bin/java.path
rpm -qa | grep -i java
whereis java
readlink -f $(which java)

A symlink dependency between the configured JRE and the full JDK directory must be confirmed first. Removing a directory that the configured JRE points into will break Splunk DB Connect.

Resolution

To resolve/fix this issue, the Java version needs to be upgraded to Java 11.

Install Java 11:

sudo yum install java-11-openjdk

Verify the installation:

java -version

Set Java 11 as the default version:

sudo alternatives --config java

Select Java 11 from the displayed list.
Retrieve the Java 11 installation path:

readlink -f $(which java)

Copy the path up to but not including /bin. Example: /usr/lib/jvm/java-11-openjdk-11.0.25.0.9-2.el8.x86_64/

• In the Splunk DB Connect UI, navigate to Configuration → Settings → JRE Installation Path (JAVA_HOME) and enter the copied path.
• Click Save. The Splunk DB Connect task server restarts and begins using Java 11.
• After confirming the symlink dependency, remove the unused vulnerable OpenJDK 1.8 directory. Both a standalone JRE and a full JDK are supported by Splunk DB Connect.

Validate the upgrade by collecting the following:

• Output of java -version
• Output of "readlink -f $(which java)"
• Screenshot of the Splunk DB Connect Settings page.
• Confirmation of the Java 11 path in dbx_settings.conf under /opt/splunk/etc/apps/splunk_app_db_connect/local/.

Related Links

Configure Splunk DB Connect Settings

Configuring Splunk DB Connect