https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208580#M2153 <P>If you edited a setting within the default folder (something you should never do) simply do an upgrade or refer to the spec file where many of the defaults are outlined in the setting's description: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf</A></P> Fri, 12 Jan 2018 13:16:00 GMT sloshburch 2018-01-12T13:16:00Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208557#M2130 <P>Getting this message "File Integrity checks found files that did not match the system-provided manifest. See splunkd.log for details."<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1891iD67797F4E7EC811D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Anyone seen this before? Any idea what it's about?</P> <P>Seeing this in the splunkd.log:</P> <PRE><CODE>09-24-2016 11:12:26.554 -0400 WARN InstalledFilesHashChecker - An installed file="/opt/splunk/etc/log.cfg" did not pass hash-checking due to reason="content mismatch" </CODE></PRE> <P>I'm using log-local.cfg so I'm wondering what I messed up here.</P> Sat, 24 Sep 2016 15:03:57 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208557#M2130 sloshburch 2016-09-24T15:03:57Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208558#M2131 <P>What version of Splunk are you using?<BR /> You can read about file system monitoring here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorchangestoyourfilesystem">http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorchangestoyourfilesystem</A></P> Mon, 26 Sep 2016 10:28:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208558#M2131 lukejadamec 2016-09-26T10:28:50Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208559#M2132 <P>This actually isn't the FIM feature. Looks like something else but I'm checking if it's just a bug.</P> Mon, 26 Sep 2016 13:32:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208559#M2132 sloshburch 2016-09-26T13:32:52Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208560#M2133 <P>is there a search head cluster involved?</P> Mon, 26 Sep 2016 13:58:02 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208560#M2133 rsennett_splunk 2016-09-26T13:58:02Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208561#M2134 <P>SHC is being used and it appears this is only happening there now. Checking if the config over there is good. Running on 6.5.0.</P> Tue, 04 Oct 2016 12:18:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208561#M2134 sloshburch 2016-10-04T12:18:08Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208562#M2135 <P>Is there already a solution to this error? I'm getting the same messages and the splunkd.log is not informative.</P> Tue, 11 Oct 2016 07:53:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208562#M2135 mbschriek 2016-10-11T07:53:19Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208563#M2136 <P>Using Splunk 6.5 (clustered environment) here and also getting the messages.</P> <P>At https://[your_splunk]:8089/services/server/status//installed-file-integrity you can find an overview of the files that did not match the system-provided manifest.</P> <P>Looks like default files that were changed.</P> Thu, 13 Oct 2016 14:57:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208563#M2136 sanderdenheijer 2016-10-13T14:57:35Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208564#M2137 <P>Great catch! Root cause was some stuff I was screwing around with in regards to the <CODE>introspection_generator_addon</CODE> and <CODE>user-prefs</CODE> which were blowing away the default config. So, this is all my fault but thanks for catching the endpoint which exposed the root cause!</P> Fri, 14 Oct 2016 22:22:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208564#M2137 sloshburch 2016-10-14T22:22:35Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208565#M2138 <P>Your info helped me out too <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 17 Oct 2016 15:55:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208565#M2138 machiel 2016-10-17T15:55:26Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208566#M2139 <P>Me too! I (changed the metadata file to promote/share view but it was no more usefull anyway). Thanx.</P> Fri, 25 Nov 2016 09:28:06 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208566#M2139 fab73 2016-11-25T09:28:06Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208567#M2140 <P>getting this too... I'm trying to clear any non-INFO issues logged in splunkd.log. Also trying to document things in my deployment by adding to README files (and commenting in other conf files) -- which of course changes the hash and triggers this WARNing. Most annoying...</P> <P>Wish there was a way to update the hashes for the "InstalledFilesHashChecker" hash table...</P> <P>6.5, cluster, deployment server, etc...</P> <P>BTW, Luke, the link you provided is for file monitoring, this is not that. This is a hash check at startup to compare existing files to a manifest of ones originally installed.</P> Wed, 30 Nov 2016 16:32:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208567#M2140 Michael 2016-11-30T16:32:46Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208568#M2141 <P>That's a great example. I think in mine, it's just the meta files. Both shouldn't be so dramatic IMO. If you open a case on this, ask support to link to SPL-133233.</P> Wed, 30 Nov 2016 19:14:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208568#M2141 sloshburch 2016-11-30T19:14:24Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208569#M2142 <P>A peer of mine, Justin, showed me that <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf">limits.conf</A> has a setting, <CODE>installed_files_integrity</CODE>, that controls if the integrity items are exposed to the UI, splunkd.log, or not at all. I consider this a win!</P> Tue, 31 Jan 2017 14:15:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208569#M2142 sloshburch 2017-01-31T14:15:52Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208570#M2143 <P>I get following the above url "404: Page not found". I don't have any "installed-file-integrity" page</P> Wed, 22 Feb 2017 00:56:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208570#M2143 borkborkbork 2017-02-22T00:56:59Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208571#M2144 <P>Sounds like you might have gone to the wrong URI or port. Wanna past the URL here?</P> Mon, 27 Feb 2017 19:56:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208571#M2144 sloshburch 2017-02-27T19:56:09Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208572#M2145 <P>I don't think we posted this on here yet, but here's some background: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles">http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles</A></P> Wed, 22 Mar 2017 20:43:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208572#M2145 sloshburch 2017-03-22T20:43:22Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208573#M2146 <BLOCKQUOTE> <P>./splunk validate files</P> </BLOCKQUOTE> Tue, 28 Mar 2017 19:52:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208573#M2146 vskoryk_splunk 2017-03-28T19:52:08Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208574#M2147 <P>Yes! In fact, we just had the docs team include this banner message's text in our docs. So hopefully anyone else running into this will more easily find the docs in an internet search:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles#Interpret_results_of_an_integrity_check">http://docs.splunk.com/Documentation/Splunk/latest/Admin/ChecktheintegrityofyourSplunksoftwarefiles#Interpret_results_of_an_integrity_check</A></P> Fri, 31 Mar 2017 12:17:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208574#M2147 sloshburch 2017-03-31T12:17:43Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208575#M2148 <P>I received this error after following another thread that stated you uninstall apps by disabling them, removing the folders from ./etc/apps and then restarting. Any idea how to fix this?</P> Mon, 08 May 2017 14:57:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208575#M2148 adepasquale 2017-05-08T14:57:24Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208576#M2149 <P>@adepasquale - The message means that files that come with Splunk (listed in the manifest file) were changed after install. This might mean you removed a required app like the launcher or search app. Tread carefully there and make you everything in a base install exists. Alternatively, use the answers listed in this post to hide the messages and/or learn how to learn what files were changed.</P> Tue, 09 May 2017 13:10:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-resolve-messages-about-File-Integrity-checks-for-Splunk/m-p/208576#M2149 sloshburch 2017-05-09T13:10:49Z