topic Re: What folder permission is need to monitor bash_history? in Getting Data In

What folder permission is need to monitor bash_history?

Feedy — Tue, 29 Sep 2020 12:42:17 GMT

I've been trying to capture bash_history logs but I am not seeing this log populate in Splunk. I am able to get top, who, netstat and several others but the only one that is missing is bash_history. I checked my inputs.conf file and it matches correctly to another instance. I've also restarted the splunkforwarder. The only thing left that I am thinking could be the issue is the folder permissions for ///root/.bash_history and ///home/.../.bash_history. If that is the issue, my question is what should the permissions be set to? Here is my stanza for bash_history.

### bash history
[monitor:///root/.bash_history]
disabled = 0
sourcetype = bash_history
index = home

[monitor:///home/.../.bash_history]
disabled = 0
sourcetype = bash_history
index = home

Re: What folder permission is need to monitor bash_history?

somesoni2 — Thu, 02 Feb 2017 04:58:59 GMT

You (the account under which Splunk service is running) needs to have read permission on the file/folder it's monitoring.

Re: What folder permission is need to monitor bash_history?

Feedy — Tue, 29 Sep 2020 12:44:52 GMT

@somesoni2 how would I go about giving the Splunk user access to the ///home/.../.bash_history? The user:group shows as the current user that I'm logged in as. I am getting the logs from ///root/.bash_history? The user:group shows as root:root.

Re: What folder permission is need to monitor bash_history?

dwaddle — Tue, 07 Feb 2017 05:47:42 GMT

Might have a look at http://www.duanewaddle.com/splunking-bash-history/ for ideas. Some permissions problems and such may remain, but it's perhaps better?