All Apps and Add-ons

Splunk App for Unix and Linux: How can we customize this app to blacklist the /opt/Tanium/ partion in the df.sh script?

siva_cg
Path Finder

Hi All,

Hope you are doing good.

We have Splunk app for *nix installed on my Linux application servers and being used to monitor the stats. We have TaniumClient software installed on those servers and that partition related to this software doesn't have READ permission for the Splunk user. Due to this, we are seeing Permission Denied error messages when df.sh script from Splunk App for *nix runs.

So we decided to blacklist the /opt/Tanium/ partition in the df.sh script. So could you please help me how to blacklist this partition? Is it the same way we blacklist few logs in monitor stanza of inputs.conf?

Thanks in advance.

0 Karma

nickhills
Ultra Champion

If you create a duplicate copy of df.sh and copy this into the bin folder in the TA.
This should not get replaced during future updates, and you can amend the script to exclude the locations as you need.

In your local/inputs.conf you can blacklist the servers running Tanium from the standard df.sh script, and create a separate input for your custom tanium-df.sh script and whitelist the servers so they run this script instead.

This should be quite clean, and should survive updates of the TA in the future.

If my comment helps, please give it a thumbs up!
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @siva_cg,

There are no such configurations exist to blacklist mount point from df.sh in Splunk_TA_nix but you can modify $SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/df.sh based on your requirement but there will be problem when you upgrade this app-on in future, it will overwrite df.sh when you will upgrade.

0 Karma

hardikJsheth
Motivator

Hi @siva_cg,

I replied without completely reading the problem. - My bad.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...