Hi everyone,
I want to monitor files on a Linux server. Every hours (at minute 59), a file DATE.log is compressed into a DATE.gz.
Though inputs.conf I am monitoring all the files (DATE*). I noticed that I have some logs missing for 20 minutes (from ~ the minute 37 to the minute 59) every hours between 8am to 8pm. I checked the splunkd.log and saw this error:
WARN TailReader - Insufficient permissions to read file='.../DATE.gz' (hint: Permission denied)
I gave reading rights on the .gz files, but maybe it's not enough as the decompression is effective on the forwarder. Should I give writing rights to my splunk user on these files?
Not sure if it's gonna fix the missing logs problem but I will start with that ^^
Have a good day,
