Cannot open manifest file inside XXX: No such file or directory

[jravida]

Hi folks,

I'm troubleshooting some slowness we have on the platform. While looking at the splunkd_stderr.log, I notice multiple lines stating "Cannot open manifest file inside XXX: No such file or directory"

When I list the contents of the directory /opt/splunk/var/lib/splunk/audit, I notice that all the subdirectories (db_1341513434_123514125_33 for instance) are owned by splunk:splunk, except for today's which are owned by root:root. Those are the ones the stderr log is noting as having issues.

An upgrade was done, not by myself, and my guess is that it was installed as root, instead of the user splunk. Is there a simple fix for this or will I have to blow away any index or data?

[MuS · Accepted solution]

Hi jravida,

this usually happens if you install Splunk as root and start Splunk as root, all new files created after this start will be owned by root. But this is no problem at all, just stop Splunk and chown -R splunk:splunk /opt/splunk and start Splunk as user splunk.

hope this helps ...

cheers, MuS

[jravida]

This worked great. The errors seem to have subsided. I was hoping it would be this easy!