Getting Data In

What happens when we restart universal forwarder as root user ?

raj_mpl
Path Finder

Hi All,

So , What happens when I restart universal forwarder as root user on Linux . And Previously if done so what needs to be done if anything goes wrong

I am missing one of the log file on a particular host , but remaining logs from different sources are working fine from the same host
So restarted UF as root user ,but didn't worked

Any help ?

Thanks

0 Karma
1 Solution

FrankVl
Ultra Champion

Certain files will change owner, causing stuff to break when you then restart it under the regular user). Solution:

Stop the forwarder (as root)
chown the entire splunk directory to the correct user:group
Start the forwarder (as the correct user)

View solution in original post

0 Karma

FrankVl
Ultra Champion

Certain files will change owner, causing stuff to break when you then restart it under the regular user). Solution:

Stop the forwarder (as root)
chown the entire splunk directory to the correct user:group
Start the forwarder (as the correct user)

0 Karma

raj_mpl
Path Finder

Will that work ? And The missing log from a particular source will start indexing again if I restart the splunk UF as splunk user.

And what the thing called fish bucket .bat files in this scenario?

0 Karma

FrankVl
Ultra Champion

Not sure what the issue was with that specific log that failed to index. But in general, when a splunk instance that used to be running as a normal user, accidentally got restarted as root. What I posted is the solution to get things back to normal.

0 Karma

raj_mpl
Path Finder

Ok @FrankVl , Thanks for your quick response

Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...