https://community.splunk.com/t5/Getting-Data-In/When-installing-the-universal-forwarder-why-is-it-unable-to/m-p/225198#M44050 <P>I'm trying to install Splunk Universal Forwarder on Red Hat OS. I am getting stuck at this step. Before this command, I've already ran:</P> <PRE><CODE>chown -R splunk /opt/app/splunkforwarder chmod -R 755 /opt/app/splunkforwarder </CODE></PRE> <P>The permissions and groups are all there. For some reason, it seems like it can't create /opt/app/splunkforwarder/var folder.</P> <PRE><CODE>[root@server etc]# /opt/app/splunkforwarder/bin/splunk enable boot-start -user splunk --accept-license Warning: cannot create "/opt/app/splunkforwarder/var/log/splunk" Warning: cannot create "/opt/app/splunkforwarder/var/log/introspection" First-time-run has not finished. Ignore this error when previewing migration - exiting. </CODE></PRE> Wed, 09 Nov 2016 21:54:23 GMT dmacndawk 2016-11-09T21:54:23Z https://community.splunk.com/t5/Getting-Data-In/When-installing-the-universal-forwarder-why-is-it-unable-to/m-p/225198#M44050 <P>I'm trying to install Splunk Universal Forwarder on Red Hat OS. I am getting stuck at this step. Before this command, I've already ran:</P> <PRE><CODE>chown -R splunk /opt/app/splunkforwarder chmod -R 755 /opt/app/splunkforwarder </CODE></PRE> <P>The permissions and groups are all there. For some reason, it seems like it can't create /opt/app/splunkforwarder/var folder.</P> <PRE><CODE>[root@server etc]# /opt/app/splunkforwarder/bin/splunk enable boot-start -user splunk --accept-license Warning: cannot create "/opt/app/splunkforwarder/var/log/splunk" Warning: cannot create "/opt/app/splunkforwarder/var/log/introspection" First-time-run has not finished. Ignore this error when previewing migration - exiting. </CODE></PRE> Wed, 09 Nov 2016 21:54:23 GMT https://community.splunk.com/t5/Getting-Data-In/When-installing-the-universal-forwarder-why-is-it-unable-to/m-p/225198#M44050 dmacndawk 2016-11-09T21:54:23Z https://community.splunk.com/t5/Getting-Data-In/When-installing-the-universal-forwarder-why-is-it-unable-to/m-p/225199#M44051 <P>I think the issue is that when you run <CODE>chown -R splunk /opt/app/splunkforwarder</CODE> you are instructing that the ownership of these folders and subfolders shouldo be changed to a user called <CODE>splunk</CODE></P> <P>However when you are running the Splunk binary you are running it as a <CODE>root</CODE>:<BR /> <CODE>[root@server etc]# /opt/app/splunkforwarder/bin/splunk enable boot-start -user splunk --accept-license</CODE></P> <P>Switch to user <CODE>splunk</CODE> and then run, which should sort it out.</P> Thu, 10 Nov 2016 01:09:23 GMT https://community.splunk.com/t5/Getting-Data-In/When-installing-the-universal-forwarder-why-is-it-unable-to/m-p/225199#M44051 gokadroid 2016-11-10T01:09:23Z