topic Re: bootstart user in Security

bootstart user

VijaySrrie — Wed, 29 Jan 2020 14:09:34 GMT

Hi,

After rebooting the server when I checked splunk services were not running. So I tried to start the splunk services, but getting the below error

this command can only be run by bootstart user

Re: bootstart user

gfreitas — Wed, 29 Jan 2020 14:12:18 GMT

Check inside splunk-launch.conf for SPLUNK_OS_USER then su to this user and start the Splunk service

Re: bootstart user

nickhills — Wed, 29 Jan 2020 14:14:48 GMT

Assuming linux, and you have sudo access and your server should run as splunk.

sudo su splunk -
/opt/splunk/bin splunk start

Re: bootstart user

VijaySrrie — Wed, 29 Jan 2020 15:00:36 GMT

/etc/init.d/splunk start used to work running as the root user and we're trying to troubleshoot why it suddenly stopped working?

Re: bootstart user

nickhills — Wed, 29 Jan 2020 15:05:28 GMT

is your server using systemd?

Re: bootstart user

gfreitas — Wed, 29 Jan 2020 15:13:09 GMT

I'd recommend you check splunk-launch.conf for the user, su to the user: su <user> and then run /opt/splunk/bin/splunk start and see what error messages it shows (if any) and please note I assumed Splunk is installed under /opt/splunk

Re: bootstart user

VijaySrrie — Wed, 29 Jan 2020 17:04:52 GMT

Hi,

Issue was fixed 2 days back after restarting the splunk from /opt/splunk/bin
But we always start, stop the splunk services in /etc/init.d location, after rebooting the server and when we tried to start the service in /etc/init.d it was throwing error like "the command can only be run by bootstart user". Then I started the service in /opt/splunk/bin and it got restarted. Now, I am just curious to know why it was not working under /etc/init.d ???