Deployment Architecture

Centos 7 - Splunk 7.4.2 - Enable/Disable boot start - issues as non-root user

ehqtrainorm
Explorer

We have setup "enable boot-start" as the non-root user "splunk" and it's not systemd managed:
/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes

From what I have read, this changes the SPLUNK_OS_USER in splunk-launch.conf, as well as creates a new init.d script. However, according to this document, you still need to edit the init.d script to run splunkd as a non-root user. I would have thought that specifying "-user splunk" would have been enough to ensure this happened.

So can you please verify that, in order to properly run splunk as non-root user and for splunk to start at boot, you need to:

  1. Enable boot-start as per the command above;
  2. Edit the init.d script to ensure that the commands are being run as the appropriate non-root user.

I ask this because this makes maintenance a bit more tricky. Say I want to disable boot-start. This deletes the init.d script apparently. Then when we run the enable boot-start command again, the file is re-created, without our edits. So we need to edit the file again. Failing to do so could cause issues when splunk is started on boot as root rather than the non-root user.

ivanreis
Builder

All the times that I have to enable it at boot, I used the root id to run the command "/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes". This command already add the line to init.d when you run it under root. Maybe if you want to disable it, it would be better you sudo root and only comment the line for boot start.

Check this answer -> https://answers.splunk.com/answers/724473/major-boot-start-change-with-723-1.html

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...