Deployment Architecture

How to set automatically executable attribute of file in Splunk for Unix and Linux technology add-on

sieutruc
Contributor

Hello,

When i deploy Splunk for Unix TA by using deployment server, after client downloaded that app, it could't run immediately all the executable files because it hasn't enough right to do, i have to change the attributes (executable bit) of all files in ../bin/[scriptName].sh manually.
So do you know how to setup those attributes from deployment server, by which Universal Forwarder can run without touching anymore configuration files ?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Is your deployment server Windows? I'm guessing it is. My unix deployment servers don't have this issue. The Windows NTFS filesystem has no understanding of the execute-bit on files, and it is probably getting lost in translation between the two. I'm not sure there is a good solution here, and would recommend you reach out to Splunk support. Or, move your deployment server to a Linux host...

dwaddle
SplunkTrust
SplunkTrust

When an app is deployed by deployment server, the relevant permissions settings from the source-app in $SPLUNK_HOME/etc/deployment-apps are effectively copied. (Some things, like setuid are probably not, but let's leave those out.) If the permissions are correct on the deployment server's copy of the app, they should be correct on each deployment client. You may need to "force" the deployment clients to re-pull the app, by doing something like a blank line at the end of a .conf file, then doing a splunk reload deploy-server.

0 Karma

sieutruc
Contributor

No, i did all of them on Linux hosts (Open Suse). I copied Splunk add-on to deployment server and copied inputs.conf from default to local. After that, when i saw Splunkd.log, it said that those such scripts couldn't run. I went into the folder and chmod 744 and then it worked .
So if i do chmod in deployment server, won't client need to change attribute manually ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...