Getting Data In

Why am I getting "WARN AuthorizationManager - Unknown role" errors in splunkd.log after deleting the VMware and Windows Infrastructure apps?

bravon
Communicator

After removing the Windows Infrastructure and VMWare applications, we get the following errors in splunkd.log:

WARN AuthorizationManager - Unknown role 'winfra-admin'
WARN AuthorizationManager - Unknown role 'splunk_vmware_admin'

I can't seem to find where the old (deleted/removed) roles are referenced - can someone point me in the right direction?

Tags (4)
1 Solution

bravon
Communicator

azurite257
Explorer

It's not the authorized.conf. ess_user, ess_admin, ess_analysts would have been additional roles associated with admin account or other users defined local to the splunk (i.e. if you are using LDAP, then only system accounts that should be defined would have been admin).

Look at the $SPLUNK_HOME/etc/passwd. remove the roles associated that is no-longer existing on that splunk instance. That should get rid of the errors in the log.

:admin:$$::Administrator:admin;ess_admin;ess_analyst:changeme@example.com::

In above example, remove the entries ';ess_admin;ess_analyst' and save. Restart splunk, and error will be gone.

bravon
Communicator
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!