Deployment Architecture

How to set automatically executable attribute of file in Splunk for Unix and Linux technology add-on

sieutruc
Contributor

Hello,

When i deploy Splunk for Unix TA by using deployment server, after client downloaded that app, it could't run immediately all the executable files because it hasn't enough right to do, i have to change the attributes (executable bit) of all files in ../bin/[scriptName].sh manually.
So do you know how to setup those attributes from deployment server, by which Universal Forwarder can run without touching anymore configuration files ?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Is your deployment server Windows? I'm guessing it is. My unix deployment servers don't have this issue. The Windows NTFS filesystem has no understanding of the execute-bit on files, and it is probably getting lost in translation between the two. I'm not sure there is a good solution here, and would recommend you reach out to Splunk support. Or, move your deployment server to a Linux host...

dwaddle
SplunkTrust
SplunkTrust

When an app is deployed by deployment server, the relevant permissions settings from the source-app in $SPLUNK_HOME/etc/deployment-apps are effectively copied. (Some things, like setuid are probably not, but let's leave those out.) If the permissions are correct on the deployment server's copy of the app, they should be correct on each deployment client. You may need to "force" the deployment clients to re-pull the app, by doing something like a blank line at the end of a .conf file, then doing a splunk reload deploy-server.

0 Karma

sieutruc
Contributor

No, i did all of them on Linux hosts (Open Suse). I copied Splunk add-on to deployment server and copied inputs.conf from default to local. After that, when i saw Splunkd.log, it said that those such scripts couldn't run. I went into the folder and chmod 744 and then it worked .
So if i do chmod in deployment server, won't client need to change attribute manually ?

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...