Getting Data In

Universal forwarder for Linux had mixture of permissions for root and splunk.

splunktrainingu
Communicator

Hello, 

I am working with a Linux system and a universal forwarder. 

 

Operating System: Debian GNU/Linux 10 (buster)
            Kernel: Linux 4.19.0-12-amd64
      Architecture: x86-64

 

 

when I checked opt/splunkforwarder/etc/system/local  and ran ls -l I noticed that root root had permission in there as well as splunk splunk. Should splunk splunk own everything in the universal forwarder directory?

 

-rw-r--r-- 1 root   root   283 Apr 30  2020 inputs.conf
-rw------- 1 root   root    45 Apr 21  2020 migration.conf
-rw-r--r-- 1 root   root   222 Apr 23  2020 outputs.conf
-r--r--r-- 1 splunk splunk 265 Mar 30  2020 README
-rw------- 1 splunk splunk 431 Sep 23  2019 server.conf
-rw-r--r-- 1 splunk splunk  65 Jun  3 13:38 user-seed.conf
-rw-r--r-- 1 root   root    40 Sep 23  2019 web.conf

 

 

Labels (2)
0 Karma
1 Solution

saravanan90
Contributor

Installation might have been done in root & service is running under splunk user which could have created the splunk file. Changing it to splunk user will not have any impact if service is running under splunk.

chown splunk:splunk /opt/splunkforwarder

View solution in original post

saravanan90
Contributor

Installation might have been done in root & service is running under splunk user which could have created the splunk file. Changing it to splunk user will not have any impact if service is running under splunk.

chown splunk:splunk /opt/splunkforwarder

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...