Getting Data In

Am I breaking any best practices doing a chmod to grant a Splunk user access to Linux log files?

jwalzerpitt
Influencer

I would like to configure Splunk to monitor some log files in var/log and when i go to add data and select the directory I am not seeing all of the logs and the reason is the Splunk user I create does not have rights to see the relevant logs. I was thinking about doing a chmod to grant the Splunk user access to the log files, but if I do that will I breaking any best practices regarding accessing Linux log files?

Thx

Tags (4)
0 Karma
1 Solution

frmaasdam
Path Finder

Two possibilities here:
1. Make user Splunk member of the GID of your logfiles. Group adm? But be sure (regarding a bug) that you start your Splunk instance using su -u splunk -c
2. Or do a setfacl on the requested log files so that user splunk has the rights to execute and read the files.

View solution in original post

jwalzerpitt
Influencer

Thx for the info and options

0 Karma

frmaasdam
Path Finder

Two possibilities here:
1. Make user Splunk member of the GID of your logfiles. Group adm? But be sure (regarding a bug) that you start your Splunk instance using su -u splunk -c
2. Or do a setfacl on the requested log files so that user splunk has the rights to execute and read the files.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...