Splunk App for Unix and Linux: How can we customize this app to blacklist the /opt/Tanium/ partion in the df.sh script?

[siva_cg]

Hi All,

Hope you are doing good.

We have Splunk app for *nix installed on my Linux application servers and being used to monitor the stats. We have TaniumClient software installed on those servers and that partition related to this software doesn't have READ permission for the Splunk user. Due to this, we are seeing Permission Denied error messages when df.sh script from Splunk App for *nix runs.

So we decided to blacklist the /opt/Tanium/ partition in the df.sh script. So could you please help me how to blacklist this partition? Is it the same way we blacklist few logs in monitor stanza of inputs.conf?

Thanks in advance.

[nickhills]

If you create a duplicate copy of df.sh and copy this into the bin folder in the TA.
This should not get replaced during future updates, and you can amend the script to exclude the locations as you need.

In your local/inputs.conf you can blacklist the servers running Tanium from the standard df.sh script, and create a separate input for your custom tanium-df.sh script and whitelist the servers so they run this script instead.

This should be quite clean, and should survive updates of the TA in the future.

[harsmarvania57]

Hi @siva_cg,

There are no such configurations exist to blacklist mount point from df.sh in Splunk_TA_nix but you can modify $SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/df.sh based on your requirement but there will be problem when you upgrade this app-on in future, it will overwrite df.sh when you will upgrade.

[hardikJsheth]

Hi @siva_cg,

I replied without completely reading the problem. - My bad.