https://community.splunk.com/t5/Getting-Data-In/When-trying-to-start-Splunk-I-m-getting-an-quot-execve/m-p/119749#M24933 <P>Trying to start Splunk but getting an "execve: Permission denied " error</P> <P>This is Splunk 6.1.x and my OS is AIX. </P> <P>bin/splunk start --accept-license </P> <P>Checking prerequisites... <BR /> WARNING: File size limit (ulimit -f) is set low (1073741312 bytes) Splunk may not work. <BR /> You may want to run "ulimit -f unlimited" before starting splunk. <BR /> Checking mgmt port [8089]: open <BR /> Creating: /opt/splunkforwarder/var/lib/splunk <BR /> Creating: /opt/splunkforwarder/var/run/splunk <BR /> Creating: /opt/splunkforwarder/var/run/splunk/appserver/i18n <BR /> Creating: /opt/splunkforwarder/var/run/splunk/appserver/modules/static/css <BR /> Creating: /opt/splunkforwarder/var/run/splunk/upload <BR /> Creating: /opt/splunkforwarder/var/spool/splunk <BR /> Creating: /opt/splunkforwarder/var/spool/dirmoncache <BR /> Creating: /opt/splunkforwarder/var/lib/splunk/authDb <BR /> Creating: /opt/splunkforwarder/var/lib/splunk/hashDb <BR /> New certs have been generated in '/opt/splunkforwarder/etc/auth'. <BR /> Checking conf files for problems... <BR /> Done <BR /> All preliminary checks passed. </P> <P>Starting splunk server daemon (splunkd)... <BR /> execve: Permission denied </P> Wed, 10 Sep 2014 20:43:19 GMT DerekB 2014-09-10T20:43:19Z https://community.splunk.com/t5/Getting-Data-In/When-trying-to-start-Splunk-I-m-getting-an-quot-execve/m-p/119749#M24933 <P>Trying to start Splunk but getting an "execve: Permission denied " error</P> <P>This is Splunk 6.1.x and my OS is AIX. </P> <P>bin/splunk start --accept-license </P> <P>Checking prerequisites... <BR /> WARNING: File size limit (ulimit -f) is set low (1073741312 bytes) Splunk may not work. <BR /> You may want to run "ulimit -f unlimited" before starting splunk. <BR /> Checking mgmt port [8089]: open <BR /> Creating: /opt/splunkforwarder/var/lib/splunk <BR /> Creating: /opt/splunkforwarder/var/run/splunk <BR /> Creating: /opt/splunkforwarder/var/run/splunk/appserver/i18n <BR /> Creating: /opt/splunkforwarder/var/run/splunk/appserver/modules/static/css <BR /> Creating: /opt/splunkforwarder/var/run/splunk/upload <BR /> Creating: /opt/splunkforwarder/var/spool/splunk <BR /> Creating: /opt/splunkforwarder/var/spool/dirmoncache <BR /> Creating: /opt/splunkforwarder/var/lib/splunk/authDb <BR /> Creating: /opt/splunkforwarder/var/lib/splunk/hashDb <BR /> New certs have been generated in '/opt/splunkforwarder/etc/auth'. <BR /> Checking conf files for problems... <BR /> Done <BR /> All preliminary checks passed. </P> <P>Starting splunk server daemon (splunkd)... <BR /> execve: Permission denied </P> Wed, 10 Sep 2014 20:43:19 GMT https://community.splunk.com/t5/Getting-Data-In/When-trying-to-start-Splunk-I-m-getting-an-quot-execve/m-p/119749#M24933 DerekB 2014-09-10T20:43:19Z https://community.splunk.com/t5/Getting-Data-In/When-trying-to-start-Splunk-I-m-getting-an-quot-execve/m-p/119750#M24934 <P>The problem here is that splunk was configured with boot start enabled. On AIX, this will put a line in the /etc/inittab file which will then be run by startsrc. This seems fine except startsrc is run by root and if your Splunk install is configured to run as a different user, you can get a "permission denied" error. </P> <P>To fix this, remove the line in /etc/inittab that references Splunk and restart. </P> <P>If you do want Splunk to start at boot time, you could configure it with the "enable boot start" but just make sure to set the user Splunk will run as correctly. This doc page is a good reference.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/ConfigureSplunktostartatboottime">http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/ConfigureSplunktostartatboottime</A> </P> Wed, 10 Sep 2014 20:47:57 GMT https://community.splunk.com/t5/Getting-Data-In/When-trying-to-start-Splunk-I-m-getting-an-quot-execve/m-p/119750#M24934 DerekB 2014-09-10T20:47:57Z