Deployment Architecture

Getting the following error in splunkd - Could not find user="system" with strategy="LDAP"

chrisfrigo
Path Finder

Hello community fellows,

I'm experiencing the following errors in splunkd from each of the shc members.

INFO AuthenticationManagerLDAP - Could not find user="system" with strategy="LDAP"
INFO AuthenticationManagerLDAP - Could not find user="system" with strategy="LDAP"

have checked using the following. no luck finding what is referencing system user.

find /opt/splunk/ -name *.meta -exec grep "owner = system" {} \; -print
find /opt/splunk -type f -exec grep -H 'owner = system' {} \;
find /opt/splunk -type f -exec grep -H 'user = system' {} \;

tried adding a local user, no further errors occur. can anyone suggest what may be referencing system user?

Tags (1)

chrisfrigo
Path Finder

Engineering had confirmed this as a known issue and advised this will be addressed in next patch. Awaiting to find out which will be the next patch release.

jayroon
Engager

Ah thanks ran into this after patching as well.

0 Karma

jamesbrock
Path Finder

Good to know that it is being addressed, thanks for the info.

0 Karma

johant
Explorer

Hi,

I have the same issue as well.
Has the patch been released? Is there a website from Splunk to track the patches?

Thanks,
Johan

nikita_p
Contributor

Hi @jamesbrock,
Did you check below splunk answer. There is lot of discussion and solution which might help you.
https://answers.splunk.com/answers/49525/splunkd-log-error-message.html

0 Karma

jamesbrock
Path Finder

Hi @nikita_p,

Thanks for the reply, I did find that same post and ended up adding the user which quiets the log entries down.

0 Karma

chrisfrigo
Path Finder

you can also change the log level to quiet it down

splunk set log-level AuthenticationManagerLDAP -level NOTICE

0 Karma

jamesbrock
Path Finder

I'm currently working on this same issue. Not able to find anything with the owner of system.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...