topic WARN FilesystemChangeWatcher - error getting attributes of path : Permission denied in Monitoring Splunk

WARN FilesystemChangeWatcher - error getting attributes of path : Permission denied

tkrishna — Tue, 17 Jul 2018 00:12:43 GMT

emphasized text
Hi,

      I am trying to send oracle listener log xml files to splunk but i am getting below error . I am able to send /var/log/messages from the same server to splunk

WARN FilesystemChangeWatcher - error getting attributes of path "/alert": Permission denied

Re: WARN FilesystemChangeWatcher - error getting attributes of path : Permission denied

renjith_nair — Tue, 17 Jul 2018 01:23:44 GMT

Hi @tkrishna ,

This looks like a file read permission issue.

Switch to 'splunk' user and try to read these files.
Make sure that the splunk user is able to read parent directories also and execution bit is set on the directory level
Run splunk list monitor as splunk user and check if the file is listed.

Re: WARN FilesystemChangeWatcher - error getting attributes of path : Permission denied

tkrishna — Tue, 17 Jul 2018 01:30:19 GMT

HI Renjith,

      we don't have spunk user setup. Is it mandatory to have splunk user ? . As i can send /var/log/messages to indexer

Re: WARN FilesystemChangeWatcher - error getting attributes of path : Permission denied

renjith_nair — Tue, 17 Jul 2018 03:07:23 GMT

Nope, by splunk user I mean whichever user you are using to run splunk , hopefully its not root