topic Re: Splunk_TA_nix in All Apps and Add-ons

Splunk_TA_nix

edwardrose — Tue, 29 Sep 2020 21:13:26 GMT

Hello All,

So on a quite a few of our Splunk servers we are running Splunk as a non-root user. Well we deploy Splunk_TA_nix 6.0.0 to all our Linux clients. Quite a few of the scripts that get run as part of the TA_nix add-on require root privs to execute properly. How do I get around this?

Thanks
ed

Re: Splunk_TA_nix

sloshburch — Thu, 03 Jan 2019 17:28:02 GMT

Ultimately, you'll need to make sure the unix ID running Splunk can run the requisite commands on the command line of the unix OS terminal/command prompt without errors.

Often, this is resolved by having the admin of the OS provide the permissions needed.

If you end up working on collecting files as well, this post might be of help: Which UNIX permissions are best for monitoring files?

Re: Splunk_TA_nix

sloshburch — Mon, 07 Jan 2019 18:52:48 GMT

Actually, what commands have root requirement? I'm not seeing any.

Even though the processes they use might be owned by root, those commands should ultimately have the permissions -rwxr-xr-x so group and other users can read and execute. The same is true for the parent directory of those commands.

Re: Splunk_TA_nix

michael_schmidt — Mon, 07 Jan 2019 18:57:53 GMT

I'd bet a dollar that the deployment server is Windows based. Windows based deployers totally foul up the permissions of the TA_nix when they push it.

Re: Splunk_TA_nix

sloshburch — Wed, 16 Jan 2019 20:20:53 GMT

In that theme, here's more info that delve into the Windows considerations: What are best practices for deploying the Splunk Add-on for Unix and Linux in a distributed environment?