Getting Data In

Linux Universal Forwarder - Security Recommendations


Hello Splunk-Community,

for month we are discussing with our Linux admins, if it is ok to install Splunk Universal Forwarder on Linux (Red Hat) or not.
We just want to collect Tomcat / Apache logs from various Linux Hosts, and really don't know how.

The main concern is the management of the needed permissions (per Host / Application for about 1000 Linux Systems) to get the Forwarder to the needed application log directories. We don't want to run the Forwarder as root.

So what are you doing? Do you have any best practices?
I can't belive we are the only one facing this discussion.

Thank you

PS: As a side note, at Windows it seems to be ok to run the Forwarder as System Service.....


Hi splk,
Apache logs have usually read rights for group (640), in this case you could install UF using a not root user (a new one without shell active) but belonging to the same group of the logs owner.

At you can find instruction to install Splunk on linux as not root user.


0 Karma


We've solved this by creating a group on the systems that has read access only to the log files we want to process.

We configured the syslog service (rsyslog) to write logs with the file permissions 640 with the file group ownership set to the log review group, and we've added the Splunk forwarder service account to this group. You also have to mind your directory permissions to make sure that the Splunk service account can access the directory tree & enumerate/read files.

Also make sure the forwarder web interface is disabled and the service account is properly restricted.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...