Archive

Error adding SSHFS mount as a data input

New Member

on a mac os x server, I am trying to add a directory as input. I encounter the following error when trying to save the Monitor

"Encountered the following error while trying to save: In handler 'monitor': Path is not readable."

the path is /Volumes/wliprod02, and I can access this path as my local admin user. The volume is mounted via sshfs.

splunkd is running as root user. so it should have access.. I cant see any error being logged to splunkd.log in conjunction with that

Not sure what is wrong, any insight is appreciated!

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

One of the things to check when feeding Splunk an SSHFS mount to monitor is that the underlying mount point directory also has adequate ownership/permissions.

We have seen instances where the directories traversed were all showing the expected owner/permissions with the SSHFS share mounted (root:root/750 for example) but Splunk was unable to monitor the files in the share because the underlying mount point belonged to a different user.

This will show up in $SPLUNK_HOME/var/log/splunkd.log in the following way :

splunkd.log:06-27-2010 11:37:02.229 INFO TailingProcessor - Parsing configuration stanza: monitor:///var/log/sshfs_mountpoint. splunkd.log:06-27-2010 11:37:02.229 WARN FilesystemChangeWatcher - error getting attributes of path "/var/log/sshfs_mountpoint": Permission denied

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!