dealing with UF user change (linux)

[ilhwan]

I haven't upgraded UF in a while, and I'm having some trouble figuring out how I should proceed with bringing it up to date.  I see that the current version has changed the user from splunk to splunkfwd.  I also see that updating an existing UF keeps the user as splunk (this seems to work but not always).  This will means that new installations will use a different username than updated UF.

This is a problem for me because I use scripts to make the permission changes to give splunk access to the appropriate log files.  I'm not finding a lot of guidance on how to keep this sane.  How have other organizations dealt with this?

I'm tempted to uninstall UF and do a fresh install on every system.  That will force me to manage splunk servers differently than other linux servers, but that has to be less complicated than trying to keep track of which systems use splunk and which use splunkfwd.

[dural_yyz]

Do you use scripts to do your install/upgrade.  Post event could you not just CHOWN the whole directory back to the original user of splunk to run as you originally have done.

There are many reasons why this might not work for you.  Honestly though given that this is the new direction it would be something you have to carry forward with every upgrade.  While it would be a big lift the idea of moving everything over now might be easier than trying to always revert back to splunk user.

[ilhwan]

I'd rather chown the old version and make it match the new one.  I think I tried that on one of my update tests, and it complained a lot before failing.  That's kinda why I'm thinking of uninstalling the old one and installing it fresh.