topic Directory and config file permissions keep getting reset by Splunk (need 744) in Security

Directory and config file permissions keep getting reset by Splunk (need 744)

the_wolverine — Thu, 30 Jun 2011 04:16:42 GMT

We have a workaround in place to address the replication bug in our current version of Splunk (4.1x). Our /opt/splunk/etc/ directory is shared to the indexers via nfs export and replication is disabled.

Unfortunately, when a change is made to props.conf, Splunk changes the permissions of the directory and files (/opt/splunk/etc/apps/search/local/props.conf) to 700.

I have manually changed permissions to 744 only to have them changed back when I (or another user) make a change, such as add field extractions, from UI. This breaks all custom field extractions.

How can I force Splunk not to change the permissions on these directories and files?

Re: Directory and config file permissions keep getting reset by Splunk (need 744)

the_wolverine — Tue, 23 Aug 2011 05:54:12 GMT

This is a known issue and splunk support should be able to confirm and answer it. So, I'm surprised they have not responded here yet.

Re: Directory and config file permissions keep getting reset by Splunk (need 744)

yoho — Tue, 13 May 2014 12:38:49 GMT

Maybe changing the umask when splunk gets started would change something to this situation ?

Re: Directory and config file permissions keep getting reset by Splunk (need 744)

anderius — Fri, 09 Jan 2015 10:03:35 GMT

What happened? Was it solved? This is not a solution/answer to the problem for other people reading the post... 🙂