How does the user:group get set for a deployed app to the universal forwarder?

[fblau]

When I deploy an app to my universal forwarder, it has root:root ownership. Is there any way to set that to another user that is better suited to running on the forwarder?

[esix_splunk]

Permissions are retained from Unix to Unix hosts, and Windows to Windows hosts.

However a Linux DS deploying to Windows, and vice-a-versa, a Windows DS deploying to Linux will not retain permissions file system permissions.

This typically is only a problem in the *Nix world, where you're running your DS as 'splunk' or a non-root id, and you actually want it to be root or a different uid on the client.

In the case where you are deploying to different OS's, it's better to setup a script to chown the $splunk_home$/etc/apps and run that frequently as you need to.

Windows works a bit differently, as you can setup the filesystem to inherit from the parent folder and this typically works as designed.

[woodcock]

it makes a HUGE difference if your DS is Windows or Linux so which is it? If it is Linux, the permissions should be preserved but if your DS is Windows and your DC is Linux, you may be in for trouble; the last time I tried that I could not make it work but it was V5...