Deployment Architecture

Centos 7 - Splunk 7.4.2 - Enable/Disable boot start - issues as non-root user

ehqtrainorm
Explorer

We have setup "enable boot-start" as the non-root user "splunk" and it's not systemd managed:
/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes

From what I have read, this changes the SPLUNK_OS_USER in splunk-launch.conf, as well as creates a new init.d script. However, according to this document, you still need to edit the init.d script to run splunkd as a non-root user. I would have thought that specifying "-user splunk" would have been enough to ensure this happened.

So can you please verify that, in order to properly run splunk as non-root user and for splunk to start at boot, you need to:

  1. Enable boot-start as per the command above;
  2. Edit the init.d script to ensure that the commands are being run as the appropriate non-root user.

I ask this because this makes maintenance a bit more tricky. Say I want to disable boot-start. This deletes the init.d script apparently. Then when we run the enable boot-start command again, the file is re-created, without our edits. So we need to edit the file again. Failing to do so could cause issues when splunk is started on boot as root rather than the non-root user.

ivanreis
Builder

All the times that I have to enable it at boot, I used the root id to run the command "/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes". This command already add the line to init.d when you run it under root. Maybe if you want to disable it, it would be better you sudo root and only comment the line for boot start.

Check this answer -> https://answers.splunk.com/answers/724473/major-boot-start-change-with-723-1.html

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...