All Apps and Add-ons

How can I monitor root-owned logs while running Splunk as a non-root user?

vin02
Path Finder

How to monitor root-owned logs while running Splunk as a non-root user for Amazon Linux AMI?
what are the permission required for non-root user to run the environment ?

0 Karma

tmarlette
Motivator

whatever user that is running splunk needs r/w access to $SPLUNK_HOME, and read to whatever root owned logs.

best guess here is to create a group that has read access to those logs, but retains root ownership, and add the splunk user to that group in linux.

vin02
Path Finder

Thanks for the answer. What is the command for the same?

0 Karma

lguinn2
Legend

@vin02 - that would be an OS command, not a Splunk command, so it would depend on your operating system.

0 Karma

vin02
Path Finder

we are using Amazon Linux.

0 Karma

lguinn2
Legend

If you need help with Linux commands, you could start with the AWS Linux documentation
https://aws.amazon.com/premiumsupport/knowledge-center/linux-command-basics/

You could also use any reference for Cento OS, and that is the base for AWS Linux

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...