topic Re: Splunk UF monitoring logs that is not accessible to is underlying user in Getting Data In

Splunk UF monitoring logs that is not accessible to is underlying user

MrYanYan — Fri, 20 Aug 2021 09:40:12 GMT

Hi Fellas!

I just wanted to ask if it would be possible for a Splunk UF to monitor logs that is not accessible to its underlying user.

For example, I am running my Splunk UF instance under the splunk user and I am try to capture data from files under the directory /var/logs/appservicename/*.log which is owned by root user. Given the I have the correct configuration at inputs.conf and outputs.conf, will the data be transmitted to my indexer instance?

Re: Splunk UF monitoring logs that is not accessible to is underlying user

gcusello — Fri, 20 Aug 2021 09:45:22 GMT

Hi @MrYanYan,

if the user thet you user to run Splunk hasn't the right to read the files in a folder, you cannot do it obviously!

The only ways are:

insert the splunk user in the root group,
temporary create a copy of those files in another folder accessible from splunk user and then delete them after few minutes.

Ciao.

Giuseppe

Re: Splunk UF monitoring logs that is not accessible to is underlying user

venkatasri — Fri, 20 Aug 2021 09:46:09 GMT

@MrYanYan Splunk user must be able to read the file owned by root user to monitor the file.

Re: Splunk UF monitoring logs that is not accessible to is underlying user

MrYanYan — Fri, 20 Aug 2021 09:49:32 GMT

Got it @gcusello , I just cant find an article that would support this observation of mine.

Thank you! :😄