All Apps and Add-ons
Highlighted

Splunk_TA_nix

Communicator

Hello All,

So on a quite a few of our Splunk servers we are running Splunk as a non-root user. Well we deploy SplunkTAnix 6.0.0 to all our Linux clients. Quite a few of the scripts that get run as part of the TA_nix add-on require root privs to execute properly. How do I get around this?

Thanks
ed

0 Karma
Highlighted

Re: Splunk_TA_nix

Ultra Champion

Ultimately, you'll need to make sure the unix ID running Splunk can run the requisite commands on the command line of the unix OS terminal/command prompt without errors.

Often, this is resolved by having the admin of the OS provide the permissions needed.

If you end up working on collecting files as well, this post might be of help: Which UNIX permissions are best for monitoring files?

0 Karma
Highlighted

Re: Splunk_TA_nix

Ultra Champion

Actually, what commands have root requirement? I'm not seeing any.

Even though the processes they use might be owned by root, those commands should ultimately have the permissions -rwxr-xr-x so group and other users can read and execute. The same is true for the parent directory of those commands.

0 Karma
Highlighted

Re: Splunk_TA_nix

Path Finder

I'd bet a dollar that the deployment server is Windows based. Windows based deployers totally foul up the permissions of the TA_nix when they push it.

0 Karma
Highlighted

Re: Splunk_TA_nix

Ultra Champion

In that theme, here's more info that delve into the Windows considerations: What are best practices for deploying the Splunk Add-on for Unix and Linux in a distributed environm...

0 Karma