Hi there!
How are you doing?
Our FIM tool is detecting modifications to the /etc/passwd file by the splunkfwd user found on some of our critical Linux servers for our operation with Splunk Universal Forwarder installed.
Do you know if this behavior is correct? Shouldn't it be modifying /opt/splunkforwarder/etc/passwd?
Thank you very much!
Regards,
Juanma
PS: when echoing $SPLUNK_HOME it appears to be blank in other users, but the tools is sending logs correctly to SplunkCloud
