Archive

Receiving this warning: "cannot create "/opt/splunk/var/log/watchdog"

Engager

Why am I receieving this error?

Warning: cannot create "/opt/splunk/var/log/watchdog"

Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
0 Karma

SplunkTrust
SplunkTrust

This can happen if Splunk is run as root and then run as a non-root user without changing the ownership of all files in /opt/splunk.

---
If this reply helps you, an upvote would be appreciated.

Motivator

Agree with Rich, I've seen this behavior in the very same circumstances.

chown the pid file to the user running splunk.
e.g.
chown splunk:splunk /opt/splunk/var/run/splunk/splunkd.pid
cycle splunk

0 Karma

Moderator
Moderator

Hi @dataops

Thank you for posting your question on Splunk Answers. In order for experts to help you, can you please provide more information in context that resulted in you seeing this error? Were you making changes to the authorize.conf file?

Thanks

0 Karma