Permission Denied when checking status of Splunk

[pfabrizi]

I get these errors when trying to check the status of SPLUNK after a restart of the device:
Pid file "/trvapps/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission de nied
Cannot initialize: /trvapps/splunk/etc/system/metadata/local.meta: Permission de nied
Cannot initialize: /trvapps/splunk/etc/system/metadata/local.meta: Permission de nied
Cannot initialize: /trvapps/splunk/etc/system/metadata/local.meta: Permission de nied
Pid file "/trvapps/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission de nied
splunkd.pid file is unreadable.
Pid file "/trvapps/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission de nied

[pfabrizi]

I found that the files in question had root:root as owner. I changed to splunk and I was able to run the command okay.

Can someone tell me how these got set to root?

Thanks!

[harsmarvania57]

Great, you found the issue. Have you enabled splunk boot start using command $SPLUNK_HOME/bin/splunk enable boot-start ? If yes then server will start splunk during server boot as root user. If you need to start splunk as spunk user during server boot then run command $SPLUNK_HOME/bin/splunk enable boot-start -user splunk as root user which will modify boot script and due to vulnerability in this one you need to modify boot script as well. For more detailed documentation please refer https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/ConfigureSplunktostartatboottime

[pfabrizi]

Thanks, I went back through my procedures and found that when I originally installed I didn't have the -user splunk argument. I have since added that.

Thanks!

[harsmarvania57 · Accepted solution]

It looks like you are running splunk as X user and you are trying to check splunk status with Y user and Y user does not have permission to read those files/directory created by X user so you are getting this error.