https://community.splunk.com/t5/Getting-Data-In/splunkfwd-user-access-to-root-owned-logs/m-p/691361#M114994 <P>Can anyone tell me the best practice for splunkfwd user to access&nbsp; others and root own dir/logs ?</P><P>&nbsp;</P><P>Not interested in changing dir/log ownership.</P><P>We could do ACL - lots of work there.</P><P>Out of the box what is the access level of the splunkfwd post install ?</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Sun, 23 Jun 2024 11:58:35 GMT jcorcorans 2024-06-23T11:58:35Z https://community.splunk.com/t5/Getting-Data-In/splunkfwd-user-access-to-root-owned-logs/m-p/691361#M114994 <P>Can anyone tell me the best practice for splunkfwd user to access&nbsp; others and root own dir/logs ?</P><P>&nbsp;</P><P>Not interested in changing dir/log ownership.</P><P>We could do ACL - lots of work there.</P><P>Out of the box what is the access level of the splunkfwd post install ?</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Sun, 23 Jun 2024 11:58:35 GMT https://community.splunk.com/t5/Getting-Data-In/splunkfwd-user-access-to-root-owned-logs/m-p/691361#M114994 jcorcorans 2024-06-23T11:58:35Z https://community.splunk.com/t5/Getting-Data-In/splunkfwd-user-access-to-root-owned-logs/m-p/691362#M114995 <P>Enable the CAP_DAC_READ_SEARCH capability.&nbsp; See <A href="https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/Installleastprivileged" target="_blank">https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/Installleastprivileged</A></P> Sun, 23 Jun 2024 13:15:48 GMT https://community.splunk.com/t5/Getting-Data-In/splunkfwd-user-access-to-root-owned-logs/m-p/691362#M114995 richgalloway 2024-06-23T13:15:48Z