Monitoring Splunk

Can you help us with a Splunk Root user Issue?

rohitvjoshi
Path Finder

Hi Splunkers,

Last week, one of our search head went down and we tried to restart the server. We have done some troubleshooting and identified that the Splunk server is running as a root user. After connecting with the network team, we are able to run the Splunk services again as a Splunk user.

We want to understand who has logged in as Root in the server and track down the Ip etc.

We need some guidance on the same.

Thanks,

RJ

Tags (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. This doesn't sound like a Splunk question. Sounds more like an operating system question.

If this happened on a Linux server, typically /var/log/messages would record such events. For example

Dec 28 07:50:16 myserver.mycompany.com sudo:  burwell : TTY=pts/0 ; PWD=/home/burwell ; USER=root ; COMMAND=/usr/local/bin/bash

I am sure your networking people can help you figure this out.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...