Installation

Scripted input in UF permission denied to run the script

hpmist198
Engager

I have installed an app on the forwarder with scripted input. 
It's throwing an error while starting Splunk using 'Splunk' user 

 

 

11/9/20
9:13:20.631 PM	
11-09-2020 21:13:20.631 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/AWSMData/bin/awsmeta.sh" /bin/sh: /opt/splunkforwarder/etc/apps/AWSMetaData/bin/awsmetarun.sh: Permission denied
host = host.ip.internalindex = _internalsource = /opt/splunkforwarder/var/log/splunk/splunkd.logsourcetype = splunkd
11/9/20

 

 

I tried to set the permission to this script located under SPLUNK_HOME/etc/apps/<appname>/bin/<script>
But whenever i restart Splunk daemon, the permission revokes 

Labels (3)

vikramyadav
Contributor

Hi @hpmist198 ,

Can you please check what ownership is assign to Splunk? If proper ownership is not assigned to your path of Splunk, you can give proper permission by running the command
chown -R splunk:splunk /opt/splunk

--------------------------------------------------------

If this helps your like will be appreciated 😀

hpmist198
Engager

Yes ownership and permission looks ok for me. It's owned by splunk user and group.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
And this script has execution bit up?
You can test it by command:
/opt/splunkforwarder/bin/splunk cmd /opt/splunkforwarder/etc/apps/AWSMData/bin/awsmeta.sh and check why it don't run.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...