Security

Am I able to remove Indexer Search Peer - log4j?

rlaan
Path Finder

Hello, 
In a Log4J scan the following directory was flagged for containing comprimised log4j.jar files.

The files are contained in the below directory although the host being used is that of depricated servers in our infrastructure. I have migrated all of our splunk enterprise components to newer architecture and there exists 

I am curious if there is a correct way to remove the old hosts under searchpeer including all the <old_host>.* files. If unused can I just deleted them?

/opt/splunk/var/run/searchpeers/<old_host>-1641917646  (no longer exists)
/opt/splunk/var/run/searchpeers/<current_host>-1641917646   (active host in use)

File that is being caught by scan, 
/opt/splunk/var/run/searchpeers/<old_host->41917646/apps/splunk_archiver/java-bin/jars/vendors/spark/3.0.1/lib/log4j-core-2.13.3.jar

If the directories cant be safely removed i believe other documentation to say just the .jar can be removed safely.


Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it is safe.  If you happen to delete something that is needed then the peer will get a new copy.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, the JAR file can be removed safely.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rlaan
Path Finder

Are you familiar with everything under the searchpeer directory can be removed if the host it reference has been decomisisoned? (old search head hosts that no longer exist)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it is safe.  If you happen to delete something that is needed then the peer will get a new copy.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...