topic Re: What happens when we restart universal forwarder as root user ? in Getting Data In

What happens when we restart universal forwarder as root user ?

raj_mpl — Fri, 26 Apr 2019 09:34:23 GMT

Hi All,

So , What happens when I restart universal forwarder as root user on Linux . And Previously if done so what needs to be done if anything goes wrong

I am missing one of the log file on a particular host , but remaining logs from different sources are working fine from the same host
So restarted UF as root user ,but didn't worked

Any help ?

Thanks

Re: What happens when we restart universal forwarder as root user ?

FrankVl — Fri, 26 Apr 2019 09:38:39 GMT

Certain files will change owner, causing stuff to break when you then restart it under the regular user). Solution:

Stop the forwarder (as root)
chown the entire splunk directory to the correct user:group
Start the forwarder (as the correct user)

Re: What happens when we restart universal forwarder as root user ?

raj_mpl — Fri, 26 Apr 2019 09:42:23 GMT

Will that work ? And The missing log from a particular source will start indexing again if I restart the splunk UF as splunk user.

And what the thing called fish bucket .bat files in this scenario?

Re: What happens when we restart universal forwarder as root user ?

FrankVl — Fri, 26 Apr 2019 09:46:38 GMT

Not sure what the issue was with that specific log that failed to index. But in general, when a splunk instance that used to be running as a normal user, accidentally got restarted as root. What I posted is the solution to get things back to normal.

Re: What happens when we restart universal forwarder as root user ?

raj_mpl — Fri, 26 Apr 2019 09:49:18 GMT

Ok @FrankVl , Thanks for your quick response

Thank you 🙂