Re: splunkfwd user access to root owned logs - Splunk Community

Getting Data In

Can anyone tell me the best practice for splunkfwd user to access others and root own dir/logs ?

Not interested in changing dir/log ownership.

We could do ACL - lots of work there.

Out of the box what is the access level of the splunkfwd post install ?

Enable the CAP_DAC_READ_SEARCH capability. See https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/Installleastprivileged

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...