Error adding SSHFS mount as a data input

frank_h — Tue, 08 Jun 2010 16:11:33 GMT

on a mac os x server, I am trying to add a directory as input. I encounter the following error when trying to save the Monitor

"Encountered the following error while trying to save: In handler 'monitor': Path is not readable."

the path is /Volumes/wliprod02, and I can access this path as my local admin user. The volume is mounted via sshfs.

splunkd is running as root user. so it should have access.. I cant see any error being logged to splunkd.log in conjunction with that

Not sure what is wrong, any insight is appreciated!

Re: Error adding SSHFS mount as a data input

hexx — Fri, 02 Jul 2010 02:33:01 GMT

One of the things to check when feeding Splunk an SSHFS mount to monitor is that the underlying mount point directory also has adequate ownership/permissions.

We have seen instances where the directories traversed were all showing the expected owner/permissions with the SSHFS share mounted (root:root/750 for example) but Splunk was unable to monitor the files in the share because the underlying mount point belonged to a different user.

This will show up in $SPLUNK_HOME/var/log/splunkd.log in the following way :

splunkd.log:06-27-2010 11:37:02.229 INFO TailingProcessor - Parsing configuration stanza: monitor:///var/log/sshfs_mountpoint. splunkd.log:06-27-2010 11:37:02.229 WARN FilesystemChangeWatcher - error getting attributes of path "/var/log/sshfs_mountpoint": Permission denied

topic Error adding SSHFS mount as a data input in Monitoring Splunk

Error adding SSHFS mount as a data input

Re: Error adding SSHFS mount as a data input