All Apps and Add-ons

How do you run scripts from Splunk TA for Unix and Linux without sudo or root?

joshiro
Communicator

We need to run some scripts from the TA for Unix and Linux but some of them require privileges.
Since we arent running Splunk with sudo, each time the script runs returns privileges errors.

The scripts we are trying to run are: vmstat.sh and nfsiostat.sh
We tried configuring this scripts with suid so they run with owner root, but it is not working.

Is there anyway we can run this scripts without running Splunk with sudo?

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could add these individual commands to sudoers file and allow user splunk to run those. No need to run splunkd as root for that.

r. Ismo

0 Karma

joshiro
Communicator

We thought about sudoers but you still need to invoke the scripts using sudo and we dont want to modify them or run splunkd with sudo.

The binaries that require privileges are dmesg and nfsiostat, we also thought that we can add the suid flag to run them as owner but we dont want to change permisions from the OS binaries.

We are still looking for alternatives.

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...