topic Re: Who is BOSBURN? in Splunk Search

Who is BOSBURN?

wbfoxii — Mon, 19 Dec 2011 17:21:10 GMT

I'm getting this error message twice every 30 sec.
12-19-2011 12:15:27.539 -0500 ERROR AuthenticationManagerLDAP - Could not find user: bosburn

I can't figure out where I introduced this user. Our IDs do not use the name format. Did this come in from some app that I installed?

Re: Who is BOSBURN?

wbfoxii — Mon, 19 Dec 2011 17:25:21 GMT

Found my answer. It comes from Symantec Endpoint Protection Reporting. The app doesn't really work right anyway. I'm removing it.

Verified that the message is no longer appearing in /opt/splunk/var/log/splunk/splunkd.log

Re: Who is BOSBURN?

dwaddle — Mon, 19 Dec 2011 17:53:57 GMT

BOSBURN is the author of the app. There's apparently still some references in the app to his login ID on his own Splunk install.

You can fix this by editing $SPLUNK_HOME/etc/apps/SEP_Reporting/default/local.meta and replace all instances of owner = bosburn with owner = admin.

And I'm sure someone will nag Brian to fix this and post a new version of the app.

Re: Who is BOSBURN?

Brian_Osburn — Mon, 19 Dec 2011 19:11:22 GMT

DOH! How embarrassing. Almost like discovering that your fly was open all day.

I've uploaded a new version of the application, removing references to my username. Also, my company currently runs SEP 11, which I know isn't the latest version.