Index /var/log even though Splunk doesn't run on root

[lloydknight]

Hello Splunkers,

So our Splunk Enterprise runs on a non-root user and our requirement is to forward /var/log/secure and /var/log/messages to another splunk instance.

Is this feasible without changing the non-root to a root user?

Much appreciated!

[cahrens_deloitt]

The easiest solution that I have used in the past (while retaining as much security as possible) would be to reconfigure the syslog daemon on the system to also output log data to itself over the network. If using syslog-ng, you can do all sorts of filtering and pre-formatting to make it friendly to splunk while retaining the same format on the filesystem (EG, putting it into much easier to read key-value pairs rather than space-deliminated fields, quoting the message field, etc).

Syslog would be configured to send to 127.0.0.1:; Splunk would then be configured with an input configured to listen on that same high-numbered port. The traffic goes over the loop-back interface, so never goes outside of the box until Splunk forwards it; the /var/log filesystem remains untouched; and the events coming into Splunk can be massaged to be much friendlier to indexing / extracting.

[koshyk]

Best practice is to speak to your company's Infrastructure team (or Security team) to look into overall good practice within your organisation. If properly designed, all such logs should have a user & group associated (eg root: myreadergroup).
Ensure this is a standard for your organisation and then "splunk" user should be made member of "myreadergroup" which means all such critical files can be read by "splunk" or other tools

[somesoni2]

You have to request your linux administrator to get your 'non-root' user read access to those log files. After that Splunk should be able to monitor those logs and send to your other Splunk instance (heavy/intermediate forwarder or indexer).