All Apps and Add-ons

ossec app: ERRORFilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/active-responses.log": Permission denied

dshakespeare_sp
Splunk Employee
Splunk Employee

Customer reports issues monitoring ossec log files with Splunk, using the ossec app splunkd.log reports

07-21-2013 11:31:53.250 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/active-responses.log": Permission denied
07-21-2013 11:31:53.251 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/alerts": Permission denied
07-21-2013 11:31:53.253 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/ossec.log": Permission denied

Splunk is installed as user splunker, and splunker has read access to the files. The files and directory path have full read access though the whole directory tree. getfacl also shows full read permissions

0 Karma
1 Solution

dshakespeare_sp
Splunk Employee
Splunk Employee

The issues was resolved by adding the user splunker to the ossec group using "usermod -a -G ossec splunker" and restarting splunk

View solution in original post

crash1011
Explorer

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors
09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied
Then I found this actually did work:
- Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK
- Do a splunk list monitor (if you’ve got the same problem it won’t be listed)
- Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart
- Do another splunk list monitor to see if it has worked

Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server

dshakespeare_sp
Splunk Employee
Splunk Employee

The issues was resolved by adding the user splunker to the ossec group using "usermod -a -G ossec splunker" and restarting splunk

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...