https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208567#M2140 <P>getting this too... I'm trying to clear any non-INFO issues logged in splunkd.log. Also trying to document things in my deployment by adding to README files (and commenting in other conf files) -- which of course changes the hash and triggers this WARNing. Most annoying...</P> <P>Wish there was a way to update the hashes for the "InstalledFilesHashChecker" hash table...</P> <P>6.5, cluster, deployment server, etc...</P> <P>BTW, Luke, the link you provided is for file monitoring, this is not that. This is a hash check at startup to compare existing files to a manifest of ones originally installed.</P> Wed, 30 Nov 2016 16:32:46 GMT Michael 2016-11-30T16:32:46Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208557#M2130 <P>Getting this message "File Integrity checks found files that did not match the system-provided manifest. See splunkd.log for details."<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1891iD67797F4E7EC811D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Anyone seen this before? Any idea what it's about?</P> <P>Seeing this in the splunkd.log:</P> <PRE><CODE>09-24-2016 11:12:26.554 -0400 WARN InstalledFilesHashChecker - An installed file="/opt/splunk/etc/log.cfg" did not pass hash-checking due to reason="content mismatch" </CODE></PRE> <P>I'm using log-local.cfg so I'm wondering what I messed up here.</P> Sat, 24 Sep 2016 15:03:57 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208557#M2130 sloshburch 2016-09-24T15:03:57Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208558#M2131 <P>What version of Splunk are you using?<BR /> You can read about file system monitoring here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorchangestoyourfilesystem">http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorchangestoyourfilesystem</A></P> Mon, 26 Sep 2016 10:28:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208558#M2131 lukejadamec 2016-09-26T10:28:50Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208559#M2132 <P>This actually isn't the FIM feature. Looks like something else but I'm checking if it's just a bug.</P> Mon, 26 Sep 2016 13:32:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208559#M2132 sloshburch 2016-09-26T13:32:52Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208560#M2133 <P>is there a search head cluster involved?</P> Mon, 26 Sep 2016 13:58:02 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208560#M2133 rsennett_splunk 2016-09-26T13:58:02Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208561#M2134 <P>SHC is being used and it appears this is only happening there now. Checking if the config over there is good. Running on 6.5.0.</P> Tue, 04 Oct 2016 12:18:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208561#M2134 sloshburch 2016-10-04T12:18:08Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208562#M2135 <P>Is there already a solution to this error? I'm getting the same messages and the splunkd.log is not informative.</P> Tue, 11 Oct 2016 07:53:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208562#M2135 mbschriek 2016-10-11T07:53:19Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208563#M2136 <P>Using Splunk 6.5 (clustered environment) here and also getting the messages.</P> <P>At https://[your_splunk]:8089/services/server/status//installed-file-integrity you can find an overview of the files that did not match the system-provided manifest.</P> <P>Looks like default files that were changed.</P> Thu, 13 Oct 2016 14:57:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208563#M2136 sanderdenheijer 2016-10-13T14:57:35Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208564#M2137 <P>Great catch! Root cause was some stuff I was screwing around with in regards to the <CODE>introspection_generator_addon</CODE> and <CODE>user-prefs</CODE> which were blowing away the default config. So, this is all my fault but thanks for catching the endpoint which exposed the root cause!</P> Fri, 14 Oct 2016 22:22:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208564#M2137 sloshburch 2016-10-14T22:22:35Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208565#M2138 <P>Your info helped me out too <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 17 Oct 2016 15:55:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208565#M2138 machiel 2016-10-17T15:55:26Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208566#M2139 <P>Me too! I (changed the metadata file to promote/share view but it was no more usefull anyway). Thanx.</P> Fri, 25 Nov 2016 09:28:06 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208566#M2139 fab73 2016-11-25T09:28:06Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208567#M2140 <P>getting this too... I'm trying to clear any non-INFO issues logged in splunkd.log. Also trying to document things in my deployment by adding to README files (and commenting in other conf files) -- which of course changes the hash and triggers this WARNing. Most annoying...</P> <P>Wish there was a way to update the hashes for the "InstalledFilesHashChecker" hash table...</P> <P>6.5, cluster, deployment server, etc...</P> <P>BTW, Luke, the link you provided is for file monitoring, this is not that. This is a hash check at startup to compare existing files to a manifest of ones originally installed.</P> Wed, 30 Nov 2016 16:32:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208567#M2140 Michael 2016-11-30T16:32:46Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208568#M2141 <P>That's a great example. I think in mine, it's just the meta files. Both shouldn't be so dramatic IMO. If you open a case on this, ask support to link to SPL-133233.</P> Wed, 30 Nov 2016 19:14:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208568#M2141 sloshburch 2016-11-30T19:14:24Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208569#M2142 <P>A peer of mine, Justin, showed me that <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf">limits.conf</A> has a setting, <CODE>installed_files_integrity</CODE>, that controls if the integrity items are exposed to the UI, splunkd.log, or not at all. I consider this a win!</P> Tue, 31 Jan 2017 14:15:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208569#M2142 sloshburch 2017-01-31T14:15:52Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208570#M2143 <P>I get following the above url "404: Page not found". I don't have any "installed-file-integrity" page</P> Wed, 22 Feb 2017 00:56:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208570#M2143 borkborkbork 2017-02-22T00:56:59Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208571#M2144 <P>Sounds like you might have gone to the wrong URI or port. Wanna past the URL here?</P> Mon, 27 Feb 2017 19:56:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208571#M2144 sloshburch 2017-02-27T19:56:09Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208572#M2145 <P>I don't think we posted this on here yet, but here's some background: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles">http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles</A></P> Wed, 22 Mar 2017 20:43:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208572#M2145 sloshburch 2017-03-22T20:43:22Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208573#M2146 <BLOCKQUOTE> <P>./splunk validate files</P> </BLOCKQUOTE> Tue, 28 Mar 2017 19:52:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208573#M2146 vskoryk_splunk 2017-03-28T19:52:08Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208574#M2147 <P>Yes! In fact, we just had the docs team include this banner message's text in our docs. So hopefully anyone else running into this will more easily find the docs in an internet search:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles#Interpret_results_of_an_integrity_check">http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles#Interpret_results_of_an_integrity_check</A></P> Fri, 31 Mar 2017 12:17:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208574#M2147 sloshburch 2017-03-31T12:17:43Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208575#M2148 <P>I received this error after following another thread that stated you uninstall apps by disabling them, removing the folders from ./etc/apps and then restarting. Any idea how to fix this?</P> Mon, 08 May 2017 14:57:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208575#M2148 adepasquale 2017-05-08T14:57:24Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208576#M2149 <P>@adepasquale - The message means that files that come with Splunk (listed in the manifest file) were changed after install. This might mean you removed a required app like the launcher or search app. Tread carefully there and make you everything in a base install exists. Alternatively, use the answers listed in this post to hide the messages and/or learn how to learn what files were changed.</P> Tue, 09 May 2017 13:10:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208576#M2149 sloshburch 2017-05-09T13:10:49Z