How can I monitor root-owned logs while running Splunk as a non-root user?

[vin02]

How to monitor root-owned logs while running Splunk as a non-root user for Amazon Linux AMI?
what are the permission required for non-root user to run the environment ?

[tmarlette]

whatever user that is running splunk needs r/w access to $SPLUNK_HOME, and read to whatever root owned logs.

best guess here is to create a group that has read access to those logs, but retains root ownership, and add the splunk user to that group in linux.

[vin02]

Thanks for the answer. What is the command for the same?

[lguinn2]

@vin02 - that would be an OS command, not a Splunk command, so it would depend on your operating system.

[vin02]

we are using Amazon Linux.

[lguinn2]

If you need help with Linux commands, you could start with the AWS Linux documentation
https://aws.amazon.com/premiumsupport/knowledge-center/linux-command-basics/

You could also use any reference for Cento OS, and that is the base for AWS Linux