Getting Data In

Logrotate question to Permit Splunk user to read syslog?

daniel333
Builder

All,

I have /var/log/messages on a host I want Splunk to be able to read. Here is my log rotation config. Splunk user is working. But cannot read the file even after logrotate runs this rotation.

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
missingok
sharedscripts
postrotate
/bin/kill -HUP cat /var/run/syslogd.pid 2> /dev/null 2> /dev/null || true
/usr/bin/setfacl -m u:splunk:r /var/log/*
endscript
}

If I manually go and run "/usr/bin/setfacl -m u:splunk:r /var/log/*" it works how ever.

Am I missing something?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...