All Apps and Add-ons

How do you run scripts from Splunk TA for Unix and Linux without sudo or root?

joshiro
Communicator

We need to run some scripts from the TA for Unix and Linux but some of them require privileges.
Since we arent running Splunk with sudo, each time the script runs returns privileges errors.

The scripts we are trying to run are: vmstat.sh and nfsiostat.sh
We tried configuring this scripts with suid so they run with owner root, but it is not working.

Is there anyway we can run this scripts without running Splunk with sudo?

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could add these individual commands to sudoers file and allow user splunk to run those. No need to run splunkd as root for that.

r. Ismo

0 Karma

joshiro
Communicator

We thought about sudoers but you still need to invoke the scripts using sudo and we dont want to modify them or run splunkd with sudo.

The binaries that require privileges are dmesg and nfsiostat, we also thought that we can add the suid flag to run them as owner but we dont want to change permisions from the OS binaries.

We are still looking for alternatives.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...