https://community.splunk.com/t5/Installation/splunkfwd-user-modifying-etc-passwd/m-p/677333#M13626 <P>Hi there!</P><P>How are you doing?<BR />Our FIM tool is detecting modifications to the /etc/passwd file by the splunkfwd user found on some of our critical Linux servers for our operation with Splunk Universal Forwarder installed.<BR />Do you know if this behavior is correct? Shouldn't it be modifying /opt/splunkforwarder/etc/passwd?</P><P>&nbsp;</P><P>Thank you very much!<BR />Regards,<BR />Juanma</P><P>&nbsp;</P><P>PS: when echoing $SPLUNK_HOME it appears to be blank in other users, but the tools is sending logs correctly to SplunkCloud</P> Mon, 12 Feb 2024 20:15:04 GMT jalbarracinklar 2024-02-12T20:15:04Z https://community.splunk.com/t5/Installation/splunkfwd-user-modifying-etc-passwd/m-p/677333#M13626 <P>Hi there!</P><P>How are you doing?<BR />Our FIM tool is detecting modifications to the /etc/passwd file by the splunkfwd user found on some of our critical Linux servers for our operation with Splunk Universal Forwarder installed.<BR />Do you know if this behavior is correct? Shouldn't it be modifying /opt/splunkforwarder/etc/passwd?</P><P>&nbsp;</P><P>Thank you very much!<BR />Regards,<BR />Juanma</P><P>&nbsp;</P><P>PS: when echoing $SPLUNK_HOME it appears to be blank in other users, but the tools is sending logs correctly to SplunkCloud</P> Mon, 12 Feb 2024 20:15:04 GMT https://community.splunk.com/t5/Installation/splunkfwd-user-modifying-etc-passwd/m-p/677333#M13626 jalbarracinklar 2024-02-12T20:15:04Z