Splunk_TA_nix

[edwardrose]

Hello All,

So on a quite a few of our Splunk servers we are running Splunk as a non-root user. Well we deploy Splunk_TA_nix 6.0.0 to all our Linux clients. Quite a few of the scripts that get run as part of the TA_nix add-on require root privs to execute properly. How do I get around this?

Thanks
ed

[sloshburch]

Ultimately, you'll need to make sure the unix ID running Splunk can run the requisite commands on the command line of the unix OS terminal/command prompt without errors.

Often, this is resolved by having the admin of the OS provide the permissions needed.

If you end up working on collecting files as well, this post might be of help: Which UNIX permissions are best for monitoring files?

[sloshburch]

Actually, what commands have root requirement? I'm not seeing any.

Even though the processes they use might be owned by root, those commands should ultimately have the permissions -rwxr-xr-x so group and other users can read and execute. The same is true for the parent directory of those commands.

[michael_schmidt]

I'd bet a dollar that the deployment server is Windows based. Windows based deployers totally foul up the permissions of the TA_nix when they push it.

[sloshburch]

In that theme, here's more info that delve into the Windows considerations: What are best practices for deploying the Splunk Add-on for Unix and Linux in a distributed environm...