Linux: Splunk Universal Forwarder as non-root with supplementary groups

Path Finder



our splunk  universal forwarder is runnning under a non-root service account, which is defined in our central ldap.


We upgraded our universal forwarder from 7.3.7 to 8.0.5 and now our forwarder cannot monitor our file anymore.


The file to be monitored is set as following:

#ls -al /tmp/ldap-group-test

-rw-r-----. 1 root ldapgroup 100 Sep 1 09:27 /tmp/ldap-group-test


Our splunk service account user is a member of the group ldapgroup:

#id ldapsplunk
uid=100007(ldapsplunk) gid=100008(ldapsplunkgroup) groups=100008(ldapsplunkgroup),100009(ldapgroup)


In Splunk with a universal forwarder in version 8.0.5 we get a permission denied.

If we use a scripted input (inputs.conf) to display the user and group context of the currently running splunk forwarder session:



time=$(date +%s)

echo "${time} - ${hostname} - ${id} - ${rc}"

we get as output:

1598967093 - - uid=100007(ldapsplunk) gid=100008(ldapsplunkgroup) groups=100008(ldapsplunkgroup) context=system_u:system_r:unconfined_service_t:s0 - 0


As you can see, the membership of ldapgroup is missing here.

It seems that during the start process of the universal forwarder, the permissions for ldap groups aren't passed correctly.


Has anyone already noticed this? Are there any workarounds other than downgrading to version 7.3?


- Lorenz


Labels (2)
Tags (2)
0 Karma

Super Champion

I have tested your scenario, my splunk is running with user splunk and group splunk

I have created a new group added user to new group also.

I have created with code you shared.

when I ran using splunk cmd bash 

I can see old group and new group. 

I don't that is an issue with Splunk.

If this helps, give a like below.
0 Karma

Path Finder



local groups are working for me as well. The problem is only with groups from ldap.

Did you try with ldap groups?

And: Did you really try to run my script as a real scripted input via inputs.conf and not over regular cli?


- Lorenz

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...