Splunk does not drop privileges in Centos 7?

Path Finder

I am trying to install a new splunk indexer peer in centos 7 (splunk-6.6.5-b119a2a8b0ad-linux-2.6-x86_64.rpm) and I am seeing a big change in startup behavior:

In centos 6, if I run /opt/splunk/bin/splunk start|stop as root, splunk eventually drops privileges and runs as user splunk.

No such thing happens in centos 7, if I run /opt/splunk/bin/splunk start|stop as root, splunk continues to run as user root.

Support tells me splunk is supposed to be started as user splunk, but this is not the case in centos 6. In centos 6 the init.d script does not appear to su to user splunk before it starts splunk.

Is this the expected behavior?

Tags (1)
0 Karma


What user you use while installing splunk?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!