Why did my Splunk account lose permissions on the syslog collector server?

[dharveynswccd]

Good morning.

Came in today and noticed that no logs were being fed to Splunk from my Linux syslog collector. This collector is configured to receive logs from various systems over UDP 514, then push the logs to the Indexers. Attempts to access the log directory resulted in
"ls: cannot open directory .: Permission denied".

How can I resolve this? Thanks for your assistance.

[maciep · Accepted solution]

kinda sounds like a linux problem...contact your server administrator. And if that's you, fix the permissions issues.

[dharveynswccd]

@maciep, thanks. I worked with my Linux admin and he determined that there was a corrupted directory that needed fsk performed. I'm back in business now.

[MuS]

Can you please mark this as accepted, thanks 🙂

[dharveynswccd]

Done as requested!