Permissions for Linux forwarder on .gz log files

Getting Data In

Hi everyone,

I want to monitor files on a Linux server. Every hours (at minute 59), a file DATE.log is compressed into a DATE.gz.

Though inputs.conf I am monitoring all the files (DATE*). I noticed that I have some logs missing for 20 minutes (from ~ the minute 37 to the minute 59) every hours between 8am to 8pm. I checked the splunkd.log and saw this error:

WARN TailReader - Insufficient permissions to read file='.../DATE.gz' (hint: Permission denied)

I gave reading rights on the .gz files, but maybe it's not enough as the decompression is effective on the forwarder. Should I give writing rights to my splunk user on these files?

Not sure if it's gonna fix the missing logs problem but I will start with that ^^

Have a good day,

Get Updates on the Splunk Community!

Permissions for Linux forwarder on .gz log files

Linux

universal forwarder

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Join the Conversation

Permissions for Linux forwarder on .gz log files

Linux

universal forwarder

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security