Configuration Tracker - Linux Symbolic Link App Folder

Solev — Thu, 16 May 2024 07:36:14 GMT

Hello together,

with the introduction of the new ConfigurationTracker in Splunk 9.0 we noticed that some of our apps are not being logged.

The system is a linux single splunk enterprise server and the apps which are not being logged are not directly located under /opt/splunk/etc/apps.

Instead we do only have symbolic links to another folder on the system. It works for everything else, but the configuration tracker seems to ignore symbolic links. It is also not a permission issue of the linked folder. The linked folder has the same splunk group and permissions assigned.

/opt/splunk/etc/apps/symboliclinkapp -> /anotherfolder/symboliclinkapp

Is there an option to change the configuration tracker to also consider symbolic links?

Re: Configuration Tracker - Linux Symbolic Link App Folder

PickleRick — Thu, 16 May 2024 07:54:17 GMT

The only available options for the configuration tracker are here:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Configuration_Change_Tracker

It doesn't mention whether the config change tracker follows symlinks or not. If your experience shows that it doesn't, it means it probably doesn't and you can't change that. (I didn't test it myself).

You can submit an idea on https://ideas.splunk.com/

topic Configuration Tracker - Linux Symbolic Link App Folder in Knowledge Management

Configuration Tracker - Linux Symbolic Link App Folder

Re: Configuration Tracker - Linux Symbolic Link App Folder