Getting the following error in splunkd - Could not find user="system" with strategy="LDAP"

[chrisfrigo]

Hello community fellows,

I'm experiencing the following errors in splunkd from each of the shc members.

INFO AuthenticationManagerLDAP - Could not find user="system" with strategy="LDAP"
INFO AuthenticationManagerLDAP - Could not find user="system" with strategy="LDAP"

have checked using the following. no luck finding what is referencing system user.

find /opt/splunk/ -name *.meta -exec grep "owner = system" {} \; -print
find /opt/splunk -type f -exec grep -H 'owner = system' {} \;
find /opt/splunk -type f -exec grep -H 'user = system' {} \;

tried adding a local user, no further errors occur. can anyone suggest what may be referencing system user?

[chrisfrigo]

Engineering had confirmed this as a known issue and advised this will be addressed in next patch. Awaiting to find out which will be the next patch release.

[jayroon]

Ah thanks ran into this after patching as well.

[jamesbrock]

Good to know that it is being addressed, thanks for the info.

[johant]

Hi,

I have the same issue as well.
Has the patch been released? Is there a website from Splunk to track the patches?

Thanks,
Johan

[nikita_p]

Hi @jamesbrock,
Did you check below splunk answer. There is lot of discussion and solution which might help you.
https://answers.splunk.com/answers/49525/splunkd-log-error-message.html

[jamesbrock]

Hi @nikita_p,

Thanks for the reply, I did find that same post and ended up adding the user which quiets the log entries down.

[chrisfrigo]

you can also change the log level to quiet it down

splunk set log-level AuthenticationManagerLDAP -level NOTICE

[jamesbrock]

I'm currently working on this same issue. Not able to find anything with the owner of system.