topic Re: Receiving this warning: "cannot create "/opt/splunk/var/log/watchdog" in Security

Receiving this warning: "cannot create "/opt/splunk/var/log/watchdog"

dataops — Wed, 29 May 2019 16:59:34 GMT

Why am I receieving this error?

Warning: cannot create "/opt/splunk/var/log/watchdog"

Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied

Re: Receiving this warning: "cannot create "/opt/splunk/var/log/watchdog"

Anam — Wed, 29 May 2019 18:45:05 GMT

Hi @dataops

Thank you for posting your question on Splunk Answers. In order for experts to help you, can you please provide more information in context that resulted in you seeing this error? Were you making changes to the authorize.conf file?

Thanks

Re: Receiving this warning: "cannot create "/opt/splunk/var/log/watchdog"

richgalloway — Wed, 29 May 2019 19:43:01 GMT

This can happen if Splunk is run as root and then run as a non-root user without changing the ownership of all files in /opt/splunk.

Re: Receiving this warning: "cannot create "/opt/splunk/var/log/watchdog"

codebuilder — Thu, 30 May 2019 14:04:16 GMT

Agree with Rich, I've seen this behavior in the very same circumstances.

chown the pid file to the user running splunk.
e.g.
chown splunk:splunk /opt/splunk/var/run/splunk/splunkd.pid
cycle splunk