topic Re: After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license? in Getting Data In

After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license?

DaveyMeth — Sun, 03 Apr 2016 13:47:48 GMT

I have installed the forwarder in /opt/splunkforwarder and run the splunk start command. I get the license to read/accept, but when I accept the license I get the following message:

This appears to be your first time running this version of Splunk.
Could not open log file "/opt/splunkforwarder/var/log/splunk/first_install.log" for writing (2).

When I check the splunkforwarder directory, there is no var folder...

Any help would be appreciated.

Dave

Re: After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license?

satishsdange — Mon, 04 Apr 2016 04:01:38 GMT

I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux

Re: After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license?

jterry — Mon, 04 Apr 2016 23:31:58 GMT

yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably.

Re: After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license?

jbailey_splunk — Thu, 07 Apr 2016 13:48:38 GMT

From /opt, run "chown -R : splunkforwarder" (to change ownership)
Then, "chmod -R 744 splunkforwarder" (change permissions on everything contained within splunkforwarder)
- being the user that should own these files and directories
- being the group assigned to the user

Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories.

If you used an rpm to install, the user and group should be splunk, so an example would be:
cd /opt
chown -R splunk:splunk splunkforwarder
chmod -R 744 splunkforwarder

Hope this helps...

Re: After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license?

jterry — Thu, 07 Apr 2016 17:01:50 GMT

satishsdange gravatar image satishsdange · 3 days ago 1

I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux
Add your comment...
jterry gravatar image jterry [Splunk] satishsdange · 2 days ago

yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably.
Add your comment...
jbailey_splunk gravatar image jbailey [Splunk] jterry · 3 hours ago

Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories.

If you used an rpm to install, the user and group should be splunk, so an example would be:
cd /opt
chown -R splunk:splunk splunkforwarder
chmod -R 744 splunkforwarder

Hope this helps...