topic Can you help us with a Splunk Root user Issue? in Monitoring Splunk

Can you help us with a Splunk Root user Issue?

rohitvjoshi — Fri, 28 Dec 2018 05:53:59 GMT

Hi Splunkers,

Last week, one of our search head went down and we tried to restart the server. We have done some troubleshooting and identified that the Splunk server is running as a root user. After connecting with the network team, we are able to run the Splunk services again as a Splunk user.

We want to understand who has logged in as Root in the server and track down the Ip etc.

We need some guidance on the same.

Thanks,

Re: Can you help us with a Splunk Root user Issue?

burwell — Fri, 28 Dec 2018 08:18:10 GMT

Hi. This doesn't sound like a Splunk question. Sounds more like an operating system question.

If this happened on a Linux server, typically /var/log/messages would record such events. For example

Dec 28 07:50:16 myserver.mycompany.com sudo:  burwell : TTY=pts/0 ; PWD=/home/burwell ; USER=root ; COMMAND=/usr/local/bin/bash

I am sure your networking people can help you figure this out.