ossec app: ERRORFilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/active-responses.log": Permission denied

[dshakespeare_sp]

Customer reports issues monitoring ossec log files with Splunk, using the ossec app splunkd.log reports

07-21-2013 11:31:53.250 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/active-responses.log": Permission denied
07-21-2013 11:31:53.251 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/alerts": Permission denied
07-21-2013 11:31:53.253 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/ossec.log": Permission denied

Splunk is installed as user splunker, and splunker has read access to the files. The files and directory path have full read access though the whole directory tree. getfacl also shows full read permissions

[crash1011]

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors
09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied
Then I found this actually did work:
- Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK
- Do a splunk list monitor (if you’ve got the same problem it won’t be listed)
- Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart
- Do another splunk list monitor to see if it has worked

Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server

[dshakespeare_sp · Accepted solution]

The issues was resolved by adding the user splunker to the ossec group using "usermod -a -G ossec splunker" and restarting splunk