Getting Data In

File etc/users/users.ini presenting integrity check failures

performancemoni
Path Finder

Hello,

We have a weird warning on the integrity of the file etc/users/users.ini, if we look at the file, it contains:

[contains-uppercase]
user@domain> =user@domain_.5ec8143af5fe7888fddd625f69d704b3

It might have occured when we created a user and made a mistake with their username, we used their email address as username but we forgot to remove the ">" at the end. But anyway, now we have this stanza with this entry and a warning on file integrity.

We deleted the user and recreated it with the correct username "user@domain". The file is still the same... We checked on other Splunk instances where we don't have the integrity problem and the file users.ini is always empty. So we tried to remove the stanza from the file to make the file empty but when we restart splunk it tells us that the file is missing a stanza...

In the end we re-added the content of the file, just in case, to not have an error on restart. This file doesn't seem to have an impact on Splunk (?), but how can we remove or fix this integrity warning ?

Thank you for your help

0 Karma

woodcock
Esteemed Legend

Open a support case for sure and post back here what happens.

0 Karma

PavelP
Motivator

check the manifest file and post the output of this command:

grep users.ini $SPLUNK_HOME/splunk*manifest

check file ownership and permissions of users.ini and users.ini.default files:

ls -l $SPLUNK_HOME/etc/users/users.ini*

check logs for related warnings and errors:

grep users.ini $SPLUNK_HOME/var/log/splunk/*log
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...