ERROR BTreeCP ~~~~ \snapshot.old: Access is denied. error

[cjsweeney1]

Getting this error on a few systems...

08-28-2016 22:03:18.924 -0400 ERROR BTreeCP  - failed: failed to rename C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot to C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old: Access is denied. 

Anyone know what file and setting I should be looking at for the fix? It seems like a authentication.conf (I'm setup for LDAP authentication) setting reference and just wanted an opinion. Thanks.

[ololdach]

Hello,

could it be that you are running the forwarder as a non-privileged user? If so, you could change the ownership of the splunkhome\var directory tree to the splunk user.

Oliver

[camigirl4k3]

I have the same issue with my account. I'm trying to change the authentication.conf file to include some group mappings and it says I can't save. I am administrator on this machine...so is it because the service is still running?

[vr2312]

Hello @cjsweeney1

It seems the account Splunk is being run in the Windows Server does not have the admin privileges to remove the snapshot,old file from the location.

Once the privileges are updated, Splunk would have permission to edit the file and rename it to what is required.

We had this addressed by ensuring the permissions splunk is using in the host are updated.