Getting Data In

Why am I getting "WARN AuthorizationManager - Unknown role" errors in splunkd.log after deleting the VMware and Windows Infrastructure apps?

bravon
Communicator

After removing the Windows Infrastructure and VMWare applications, we get the following errors in splunkd.log:

WARN AuthorizationManager - Unknown role 'winfra-admin'
WARN AuthorizationManager - Unknown role 'splunk_vmware_admin'

I can't seem to find where the old (deleted/removed) roles are referenced - can someone point me in the right direction?

Tags (4)
1 Solution

bravon
Communicator

azurite257
Explorer

It's not the authorized.conf. ess_user, ess_admin, ess_analysts would have been additional roles associated with admin account or other users defined local to the splunk (i.e. if you are using LDAP, then only system accounts that should be defined would have been admin).

Look at the $SPLUNK_HOME/etc/passwd. remove the roles associated that is no-longer existing on that splunk instance. That should get rid of the errors in the log.

:admin:$$::Administrator:admin;ess_admin;ess_analyst:changeme@example.com::

In above example, remove the entries ';ess_admin;ess_analyst' and save. Restart splunk, and error will be gone.

bravon
Communicator
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.