running permissions for splunk user of forwarder on linux and solaris

[fernandoandre]

Hi

I have some universal forwaders installed on linux (suse) and solaris.

I have a user "splunk" to log to those machines and make restart to the forwarder service if necessary.

However, if I do that with splunk user, the forwarder stops sending data to my Indexer. If however I do that with a root user, the forwarder starts sending data again to Indexer.

What are the permissions a user needs to controls the splunk forwarder service in a *nix machine??

(this doesnt help - http://docs.splunk.com/Documentation/Splunk/4.3/installation/RunSplunkasadifferentornon-rootuser)

Thank you

[fernandoandre · Accepted solution]

Problem solved!
The user need read permissions to the folder where logs are being written (which it didn't have)! It doesn't have to do with the permissions for starting/stopping the service of the forwarder.

[krishnacasso]

Can you please guide how you assigned the permissions to log file. I used chmod to assign the read permissions but it is not working. When the file get rolled over the permissions were not carried so forwarder stops sending the data.