OPSEC LEA 2.0.1 setup issues

[rudyw]

I was able to pull the checkpoint cert and verified communication son the checkpoint side.

Log grabber is trying to execute as seen in splunkd.log but is reporting the following prolems:

04-06-2013 14:24:50.718 -0500 INFO  TcpOutputProc - Connected to idx=192.168.120.52:9997
04-06-2013 14:24:56.285 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:24:56.949 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:24:57.853 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:25:06.813 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:25:07.646 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:25:08.582 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:25:18.484 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:25:19.352 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:25:20.628 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable.  Auth tokens cannot be cached.
04-06-2013 14:25:20.739 -0500 INFO  TcpOutputProc - Connected to idx=192.168.120.51:9997

Does anyone have any insight?

[sjscott]

The fix for this problem is to create a home directory for the splunk account. Make sure you create it and set the appropriate permissions.

# mkdir /home/splunk
# chown splunk /home/splunk/
# chgrp splunk /home/splunk/

Then restart splunk.

[araitz]

Can you verify that the user that Splunk is running as has a home directory and can write to it?