Solved: Re: How to resolve messages about 'File Integrity ... - Page 2

sloshburch · ‎09-24-2016

Getting this message "File Integrity checks found files that did not match the system-provided manifest. See splunkd.log for details."

Anyone seen this before? Any idea what it's about?

Seeing this in the splunkd.log:

09-24-2016 11:12:26.554 -0400 WARN  InstalledFilesHashChecker - An installed file="/opt/splunk/etc/log.cfg" did not pass hash-checking due to reason="content mismatch"

I'm using log-local.cfg so I'm wondering what I messed up here.

sanderdenheijer · ‎10-13-2016

Using Splunk 6.5 (clustered environment) here and also getting the messages.

At https://[your_splunk]:8089/services/server/status//installed-file-integrity you can find an overview of the files that did not match the system-provided manifest.

Looks like default files that were changed.

View solution in original post

rsennett_splunk · ‎09-26-2016

is there a search head cluster involved?

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

sloshburch · ‎10-04-2016

SHC is being used and it appears this is only happening there now. Checking if the config over there is good. Running on 6.5.0.

mbschriek · ‎10-11-2016

Is there already a solution to this error? I'm getting the same messages and the splunkd.log is not informative.

How to resolve messages about 'File Integrity checks' for Splunk files

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

Join the Conversation