Installation

Scripted input in UF permission denied to run the script

hpmist198
Engager

I have installed an app on the forwarder with scripted input. 
It's throwing an error while starting Splunk using 'Splunk' user 

 

 

11/9/20
9:13:20.631 PM	
11-09-2020 21:13:20.631 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/AWSMData/bin/awsmeta.sh" /bin/sh: /opt/splunkforwarder/etc/apps/AWSMetaData/bin/awsmetarun.sh: Permission denied
host = host.ip.internalindex = _internalsource = /opt/splunkforwarder/var/log/splunk/splunkd.logsourcetype = splunkd
11/9/20

 

 

I tried to set the permission to this script located under SPLUNK_HOME/etc/apps/<appname>/bin/<script>
But whenever i restart Splunk daemon, the permission revokes 

Labels (3)

vikramyadav
Contributor

Hi @hpmist198 ,

Can you please check what ownership is assign to Splunk? If proper ownership is not assigned to your path of Splunk, you can give proper permission by running the command
chown -R splunk:splunk /opt/splunk

--------------------------------------------------------

If this helps your like will be appreciated 😀

hpmist198
Engager

Yes ownership and permission looks ok for me. It's owned by splunk user and group.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
And this script has execution bit up?
You can test it by command:
/opt/splunkforwarder/bin/splunk cmd /opt/splunkforwarder/etc/apps/AWSMData/bin/awsmeta.sh and check why it don't run.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...