Getting Data In

Index /var/log even though Splunk doesn't run on root

lloydknight
Builder

Hello Splunkers,

So our Splunk Enterprise runs on a non-root user and our requirement is to forward /var/log/secure and /var/log/messages to another splunk instance.

Is this feasible without changing the non-root to a root user?

Much appreciated!

0 Karma

cahrens_deloitt
New Member

The easiest solution that I have used in the past (while retaining as much security as possible) would be to reconfigure the syslog daemon on the system to also output log data to itself over the network. If using syslog-ng, you can do all sorts of filtering and pre-formatting to make it friendly to splunk while retaining the same format on the filesystem (EG, putting it into much easier to read key-value pairs rather than space-deliminated fields, quoting the message field, etc).

Syslog would be configured to send to 127.0.0.1:; Splunk would then be configured with an input configured to listen on that same high-numbered port. The traffic goes over the loop-back interface, so never goes outside of the box until Splunk forwards it; the /var/log filesystem remains untouched; and the events coming into Splunk can be massaged to be much friendlier to indexing / extracting.

0 Karma

koshyk
Super Champion

Best practice is to speak to your company's Infrastructure team (or Security team) to look into overall good practice within your organisation. If properly designed, all such logs should have a user & group associated (eg root: myreadergroup).
Ensure this is a standard for your organisation and then "splunk" user should be made member of "myreadergroup" which means all such critical files can be read by "splunk" or other tools

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You have to request your linux administrator to get your 'non-root' user read access to those log files. After that Splunk should be able to monitor those logs and send to your other Splunk instance (heavy/intermediate forwarder or indexer).

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...