All Apps and Add-ons

How do you run scripts from Splunk TA for Unix and Linux without sudo or root?

joshiro
Communicator

We need to run some scripts from the TA for Unix and Linux but some of them require privileges.
Since we arent running Splunk with sudo, each time the script runs returns privileges errors.

The scripts we are trying to run are: vmstat.sh and nfsiostat.sh
We tried configuring this scripts with suid so they run with owner root, but it is not working.

Is there anyway we can run this scripts without running Splunk with sudo?

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could add these individual commands to sudoers file and allow user splunk to run those. No need to run splunkd as root for that.

r. Ismo

0 Karma

joshiro
Communicator

We thought about sudoers but you still need to invoke the scripts using sudo and we dont want to modify them or run splunkd with sudo.

The binaries that require privileges are dmesg and nfsiostat, we also thought that we can add the suid flag to run them as owner but we dont want to change permisions from the OS binaries.

We are still looking for alternatives.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...