topic Cannot open manifest file inside XXX: No such file or directory in Security

Cannot open manifest file inside XXX: No such file or directory

jravida — Mon, 28 Sep 2020 16:41:24 GMT

Hi folks,

I'm troubleshooting some slowness we have on the platform. While looking at the splunkd_stderr.log, I notice multiple lines stating "Cannot open manifest file inside XXX: No such file or directory"

When I list the contents of the directory /opt/splunk/var/lib/splunk/audit, I notice that all the subdirectories (db_1341513434_123514125_33 for instance) are owned by splunk:splunk, except for today's which are owned by root:root. Those are the ones the stderr log is noting as having issues.

An upgrade was done, not by myself, and my guess is that it was installed as root, instead of the user splunk. Is there a simple fix for this or will I have to blow away any index or data?

Re: Cannot open manifest file inside XXX: No such file or directory

MuS — Thu, 22 May 2014 11:52:13 GMT

Hi jravida,

this usually happens if you install Splunk as root and start Splunk as root, all new files created after this start will be owned by root. But this is no problem at all, just stop Splunk and chown -R splunk:splunk /opt/splunk and start Splunk as user splunk.

hope this helps ...

cheers, MuS

Re: Cannot open manifest file inside XXX: No such file or directory

jravida — Thu, 22 May 2014 18:16:21 GMT

This worked great. The errors seem to have subsided. I was hoping it would be this easy!