After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license?

[DaveyMeth]

I have installed the forwarder in /opt/splunkforwarder and run the splunk start command. I get the license to read/accept, but when I accept the license I get the following message:

This appears to be your first time running this version of Splunk.
Could not open log file "/opt/splunkforwarder/var/log/splunk/first_install.log" for writing (2).

When I check the splunkforwarder directory, there is no var folder...

Any help would be appreciated.

Dave

[jterry]

satishsdange gravatar image satishsdange · 3 days ago 1

I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux
Add your comment...
jterry gravatar image jterry [Splunk] satishsdange · 2 days ago

yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably.
Add your comment...
jbailey_splunk gravatar image jbailey [Splunk] jterry · 3 hours ago

From /opt, run "chown -R : splunkforwarder" (to change ownership)
Then, "chmod -R 744 splunkforwarder" (change permissions on everything contained within splunkforwarder)
- being the user that should own these files and directories
- being the group assigned to the user

Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories.

If you used an rpm to install, the user and group should be splunk, so an example would be:
cd /opt
chown -R splunk:splunk splunkforwarder
chmod -R 744 splunkforwarder

Hope this helps...

[satishsdange]

I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux

[jterry]

yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably.

[jbailey_splunk]

From /opt, run "chown -R : splunkforwarder" (to change ownership)
Then, "chmod -R 744 splunkforwarder" (change permissions on everything contained within splunkforwarder)
- being the user that should own these files and directories
- being the group assigned to the user

Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories.

If you used an rpm to install, the user and group should be splunk, so an example would be:
cd /opt
chown -R splunk:splunk splunkforwarder
chmod -R 744 splunkforwarder

Hope this helps...