File etc/users/users.ini presenting integrity check failures

[performancemoni]

Hello,

We have a weird warning on the integrity of the file etc/users/users.ini, if we look at the file, it contains:

[contains-uppercase]
user@domain> =user@domain_.5ec8143af5fe7888fddd625f69d704b3

It might have occured when we created a user and made a mistake with their username, we used their email address as username but we forgot to remove the ">" at the end. But anyway, now we have this stanza with this entry and a warning on file integrity.

We deleted the user and recreated it with the correct username "user@domain". The file is still the same... We checked on other Splunk instances where we don't have the integrity problem and the file users.ini is always empty. So we tried to remove the stanza from the file to make the file empty but when we restart splunk it tells us that the file is missing a stanza...

In the end we re-added the content of the file, just in case, to not have an error on restart. This file doesn't seem to have an impact on Splunk (?), but how can we remove or fix this integrity warning ?

Thank you for your help

[woodcock]

Open a support case for sure and post back here what happens.

[PavelP]

check the manifest file and post the output of this command:

grep users.ini $SPLUNK_HOME/splunk*manifest

check file ownership and permissions of users.ini and users.ini.default files:

ls -l $SPLUNK_HOME/etc/users/users.ini*

check logs for related warnings and errors:

grep users.ini $SPLUNK_HOME/var/log/splunk/*log