WARN FilesystemChangeWatcher - error getting attributes of path : Permission denied

[tkrishna]

emphasized text
Hi,

      I am trying to send oracle listener log xml files to splunk but i am getting below error . I am able to send /var/log/messages from the same server to splunk 

WARN FilesystemChangeWatcher - error getting attributes of path "/alert": Permission denied

[renjith_nair]

Hi @tkrishna ,

This looks like a file read permission issue.

• Switch to 'splunk' user and try to read these files.
• Make sure that the splunk user is able to read parent directories also and execution bit is set on the directory level
• Run splunk list monitor as splunk user and check if the file is listed.

[tkrishna]

HI Renjith,

      we don't have spunk user setup. Is it mandatory to have splunk user ? . As i can send /var/log/messages to indexer 

[renjith_nair]

Nope, by splunk user I mean whichever user you are using to run splunk , hopefully its not root