Alerting

Ran Splunk once as root and entire instance is now crashed

nick405060
Motivator

I ran Splunk 7.2 once as root and now I'm no longer to start it again as non-root. I just get heaps of permission denied errors (mostly local.meta, but also savedsearches). Starting and then properly stopping again, as root, still doesn't fix the problem.

1) How is it acceptable that running Splunk once as root crashes your entire Splunk instance?
2) How do I fix this besides going through and chmod-ing EVERYTHING?

Tags (1)
0 Karma

laurie_gellatly
Communicator

When you do that on Linux you then need to chown -R splunk:splunk $SPLUNK_HOME
In other words, you give ownership of all the splunk files in all the subdirectories of Splunk back to the 'splunk' user (the user that should be running Splunk). Suggest you will have a similar fix in Windows.
Google suggested "takeown /f &ltsome-file-or-folder&gt /r" as an equivalent.

splunk stop
takeown .... to give the correct user ownership
as the user that should be running splunk: start splunk

...Laurie:{)

0 Karma

ddrillic
Ultra Champion

Look @nick405060, by starting it as root many files will be owned by root, so stopping and starting won't change it. As an admin person, you need to put the safeguards around it. As you can imagine, it's a very common mistake.

In order to prevent this situation, you need to set SPLUNK_OS_USER correctly in splunk-launch.conf.

splunk-launch.conf

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@nick405060 If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...