WARN FilesystemChangeWatcher - error getting attr... - Splunk Community

Monitoring Splunk

emphasized text
Hi,

      I am trying to send oracle listener log xml files to splunk but i am getting below error . I am able to send /var/log/messages from the same server to splunk

WARN FilesystemChangeWatcher - error getting attributes of path "/alert": Permission denied

Hi @tkrishna ,

This looks like a file read permission issue.

Switch to 'splunk' user and try to read these files.
Make sure that the splunk user is able to read parent directories also and execution bit is set on the directory level
Run splunk list monitor as splunk user and check if the file is listed.

---
What goes around comes around. If it helps, hit it with Karma 🙂

HI Renjith,

      we don't have spunk user setup. Is it mandatory to have splunk user ? . As i can send /var/log/messages to indexer

Nope, by splunk user I mean whichever user you are using to run splunk , hopefully its not root

---
What goes around comes around. If it helps, hit it with Karma 🙂

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...