topic Re: On what user does splunk start after restarting it from deployment server in Splunk Search

On what user does splunk start after restarting it from deployment server

ankithreddy777 — Tue, 14 Aug 2018 19:01:13 GMT

Hi,
When we restart splunk forwarder from deployment -server does it start
1) based on user defined in boot script OR
2) Based on the UserId under which is installed.

Suppose Splunk is installed under user "splunk" and boot script is defined to start as root user.

So when Splunk restarted by DS, does it run as root or splunk user .

Re: On what user does splunk start after restarting it from deployment server

somesoni2 — Tue, 14 Aug 2018 19:38:32 GMT

It'll be restarted with same user with which it was running before it downloaded app/configuration from DS.

Re: On what user does splunk start after restarting it from deployment server

gjanders — Tue, 14 Aug 2018 23:03:11 GMT

As per somesoni2's comment (which could be an answer), the process will fork a new process with the same userid to restart Splunk, it cannot change the username it was running as previously unless it's the root user.

If it was running as root I'm unsure if it will attempt to run as a different user post-restart, that might be worth testing if you have the user setting configured in the splunk-launch.conf file!

Re: On what user does splunk start after restarting it from deployment server

gjanders — Thu, 23 Aug 2018 01:23:58 GMT

As per somesoni2's comment the process will fork a new process with the same userid to restart Splunk, it cannot change the username it was running as previously unless it's the root user.

If it was running as root and you updated /opt/splunk/etc/splunk-launch.conf to have the line:

SPLUNK_OS_USER=splunk

Or similar, then it will restart as the splunk user, however this is an edge case as you would have to have it running as root, then change the file while it's running before the deployment server triggered a restart...