Splunk UF monitoring logs that is not accessible to is underlying user

[MrYanYan]

Hi Fellas!

I just wanted to ask if it would be possible for a Splunk UF to monitor logs that is not accessible to its underlying user.

For example, I am running my Splunk UF instance under the splunk user and I am try to capture data from files under the directory /var/logs/appservicename/*.log which is owned by root user. Given the I have the correct configuration at inputs.conf and outputs.conf, will the data be transmitted to my indexer instance?

[venkatasri]

@MrYanYan  Splunk user must be able to read the file owned by root user to monitor the file.

[gcusello · Accepted solution]

Hi @MrYanYan,

if the user thet you user to run Splunk hasn't the right to read the files in a folder, you cannot do it obviously!

The only ways are:

• insert the splunk user in the root group,
• temporary create a copy of those files in another folder accessible from splunk user and then delete them after few minutes.

Ciao.

Giuseppe

[MrYanYan]

Got it @gcusello , I just cant find an article that would support this observation of mine.

Thank you! :😄