Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- Directory and config file permissions keep getting...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a workaround in place to address the replication bug in our current version of Splunk (4.1x). Our /opt/splunk/etc/ directory is shared to the indexers via nfs export and replication is disabled.
Unfortunately, when a change is made to props.conf, Splunk changes the permissions of the directory and files (/opt/splunk/etc/apps/search/local/props.conf) to 700.
I have manually changed permissions to 744 only to have them changed back when I (or another user) make a change, such as add field extractions, from UI. This breaks all custom field extractions.
How can I force Splunk not to change the permissions on these directories and files?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is a known issue and splunk support should be able to confirm and answer it. So, I'm surprised they have not responded here yet.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe changing the umask when splunk gets started would change something to this situation ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is a known issue and splunk support should be able to confirm and answer it. So, I'm surprised they have not responded here yet.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What happened? Was it solved? This is not a solution/answer to the problem for other people reading the post... 🙂
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
