https://community.splunk.com/t5/Getting-Data-In/Permissions-for-Linux-forwarder-on-gz-log-files/m-p/567230#M100769 <P>Hi everyone,</P><P>I want to monitor files on a Linux server. Every hours (at minute 59), a file DATE.log is compressed into a DATE.gz.</P><P>Though inputs.conf I am monitoring all the files (DATE*). I noticed that I have some logs missing for 20 minutes (from ~ the minute 37 to the minute 59) every hours between 8am to 8pm. I checked the splunkd.log and saw this error:</P><P>WARN TailReader - Insufficient permissions to read file='.../DATE.gz' (hint: Permission denied)</P><P>I gave reading rights on the .gz files, but maybe it's not enough as the decompression is effective on the forwarder. Should I give writing rights to my splunk user on these files?</P><P>Not sure if it's gonna fix the missing logs problem but I will start with that ^^</P><P>Have a good day,</P> Thu, 16 Sep 2021 08:49:23 GMT apache_strike 2021-09-16T08:49:23Z https://community.splunk.com/t5/Getting-Data-In/Permissions-for-Linux-forwarder-on-gz-log-files/m-p/567230#M100769 <P>Hi everyone,</P><P>I want to monitor files on a Linux server. Every hours (at minute 59), a file DATE.log is compressed into a DATE.gz.</P><P>Though inputs.conf I am monitoring all the files (DATE*). I noticed that I have some logs missing for 20 minutes (from ~ the minute 37 to the minute 59) every hours between 8am to 8pm. I checked the splunkd.log and saw this error:</P><P>WARN TailReader - Insufficient permissions to read file='.../DATE.gz' (hint: Permission denied)</P><P>I gave reading rights on the .gz files, but maybe it's not enough as the decompression is effective on the forwarder. Should I give writing rights to my splunk user on these files?</P><P>Not sure if it's gonna fix the missing logs problem but I will start with that ^^</P><P>Have a good day,</P> Thu, 16 Sep 2021 08:49:23 GMT https://community.splunk.com/t5/Getting-Data-In/Permissions-for-Linux-forwarder-on-gz-log-files/m-p/567230#M100769 apache_strike 2021-09-16T08:49:23Z