All Apps and Add-ons

Splunk does not drop privileges in Centos 7?

Path Finder

I am trying to install a new splunk indexer peer in centos 7 (splunk-6.6.5-b119a2a8b0ad-linux-2.6-x86_64.rpm) and I am seeing a big change in startup behavior:

In centos 6, if I run /opt/splunk/bin/splunk start|stop as root, splunk eventually drops privileges and runs as user splunk.

No such thing happens in centos 7, if I run /opt/splunk/bin/splunk start|stop as root, splunk continues to run as user root.

Support tells me splunk is supposed to be started as user splunk, but this is not the case in centos 6. In centos 6 the init.d script does not appear to su to user splunk before it starts splunk.

Is this the expected behavior?

Tags (1)
0 Karma


What user you use while installing splunk?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...