https://community.splunk.com/t5/All-Apps-and-Add-ons/ERROR-CMSlave-failed-on-move-bundle-to-slave-apps-err-failed-to/m-p/189883#M72969 <P><DATETIME> ERROR CMSlave - failed on move bundle=&lt;$SPLUNK_HOME$&gt; /splunk/var/run/splunk/cluster/remote-bundle/######-##### to slave apps err=failed to remove dir=&lt;$SPLUNK_HOME$&gt;/splunk/etc/slave-apps.old (Permission denied)</DATETIME></P> <P>Check what user splunkD process running, is no longer able to manage these folders. Cluster master, and Indexers both need be running with sufficient permissions. Check the permissions on the /splunk/var/run and /splunk/etc/ are readable and writable by the user that splunkd is running as. Find the discrepancy, stop splunk service, and chown recursively the inconsistent directories, restart splunk. If the problem persists, look for another process like a cron job or patch cycle that is resetting permissions. </P> Mon, 28 Sep 2020 16:09:00 GMT mcronkrite 2020-09-28T16:09:00Z https://community.splunk.com/t5/All-Apps-and-Add-ons/ERROR-CMSlave-failed-on-move-bundle-to-slave-apps-err-failed-to/m-p/189883#M72969 <P><DATETIME> ERROR CMSlave - failed on move bundle=&lt;$SPLUNK_HOME$&gt; /splunk/var/run/splunk/cluster/remote-bundle/######-##### to slave apps err=failed to remove dir=&lt;$SPLUNK_HOME$&gt;/splunk/etc/slave-apps.old (Permission denied)</DATETIME></P> <P>Check what user splunkD process running, is no longer able to manage these folders. Cluster master, and Indexers both need be running with sufficient permissions. Check the permissions on the /splunk/var/run and /splunk/etc/ are readable and writable by the user that splunkd is running as. Find the discrepancy, stop splunk service, and chown recursively the inconsistent directories, restart splunk. If the problem persists, look for another process like a cron job or patch cycle that is resetting permissions. </P> Mon, 28 Sep 2020 16:09:00 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/ERROR-CMSlave-failed-on-move-bundle-to-slave-apps-err-failed-to/m-p/189883#M72969 mcronkrite 2020-09-28T16:09:00Z https://community.splunk.com/t5/All-Apps-and-Add-ons/ERROR-CMSlave-failed-on-move-bundle-to-slave-apps-err-failed-to/m-p/189884#M72970 <P>Check what user splunkD process running, is no longer able to manage these folders. Cluster master, and Indexers both need be running with sufficient permissions. Check the permissions on the /splunk/var/run and /splunk/etc/ are readable and writable by the user that splunkd is running as. Find the discrepancy, stop splunk service, and chown recursively the inconsistent directories, restart splunk. If the problem persists, look for another process like a cron job or patch cycle that is resetting permissions. </P> Sun, 16 Mar 2014 01:51:18 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/ERROR-CMSlave-failed-on-move-bundle-to-slave-apps-err-failed-to/m-p/189884#M72970 mcronkrite 2014-03-16T01:51:18Z