Universal Forwarder 9.0.* changing filesystem grou...

Installation

Hi Forum,

We have an issue with UF 9.0.5. When starting or stopping the filesytem group permissions are changed to the primary group of the technical user running splunk.

when splunk is started we always see the message:

Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R splunk_tech_user /opt/splunkforwarder"

This does not chown the user but also the group to the primary group of the user. Any chance to skip this?

version 8.* does not show this issue.

best regards,

Andreas

Get Updates on the Splunk Community!

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Data Drivers: How We're Streaming Real-Time F1 Telemetry Directly into Splunk ...

Data Drivers: Every Lap Tells a Story The Spectacle Two F1 racing sims go head-to-head on the .conf26 show ...