topic Splunk User Getting Permission Denied In Linux in Splunk Enterprise

Splunk User Getting Permission Denied In Linux

OgoSplunk — Mon, 12 Dec 2022 15:15:49 GMT

Hi,

I heard that it's frowned upon to run Splunk on the root so I created a Splunk User. I can't figure out why I can't run Splunk start, stop, and status without getting permission denied. I've changed the ownership to for /opt/splunk to the user "Splunk" that I've created because I was told it was bad to run Splunk as root. When working in my "Splunk" user account I continuously get this error whenever trying to config enable boot-start splunk.

oot@cluster-master:/opt# ./splunk/bin/splunk enable boot-start -systemd-managed 1 -user splunk

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Systemd unit file installed at /etc/systemd/system/Splunkd.service.
Configured as systemd managed service.
root@cluster-master:/opt# su splunk
splunk@cluster-master:/opt$ ./splunk/bin/splunk status

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
splunkd.pid file is unreadable.
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
splunk@cluster-master:/opt$

Re: Splunk User Getting Permission Denied In Linux

richgalloway — Mon, 12 Dec 2022 16:07:34 GMT

The enable boot-start command must be run as root because it modifies system files. You either can switch to the root user to run the command or use sudo. See https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot-start_on_.2Anix_platforms

Re: Splunk User Getting Permission Denied In Linux

OgoSplunk — Mon, 12 Dec 2022 16:23:09 GMT

@richgalloway Step 6 wants me to edit a file using nano or any text editor but I don't see the file there /splunk/etc/init.d/splunk could you help me out with this last part?

Re: Splunk User Getting Permission Denied In Linux

richgalloway — Mon, 12 Dec 2022 16:32:41 GMT

That file is created in Step 3, but only on systems not running systemd. However, given the output in the OP, I believe you should be following the steps in the "Enable boot-start on machines that run systemd" section.

Re: Splunk User Getting Permission Denied In Linux

OgoSplunk — Mon, 12 Dec 2022 16:43:55 GMT

@richgalloway you're the GOAT( GREATEST OF ALL TIME). I'll pass on the Karma now