hi!
Since splunk 6.1.1 we encounter a problem because boot-start
creates an init-script which causes the splunk process to run as user splunk - but group 0 (root) - but the files to be indexed are only available to the group splunk.
Is there a way to force the splunk-process to run as splunk:splunk?
something like
SPLUNK_OS_GROUP=splunk
(which doesn't work) in etc/splunk-launch.conf
?
regards,
philipp
This is actually a generic unix/Linux admin question. Init scripts run as root. What the parameters of the splunk user are is totally irrelevant to a default init script.
You have two options:
su -c
)chmod ug+s ~splunk/bin/splunk
), and make sure it is properly owned as splunk:splunk
.Mind you allowing it to continue running as root should not pose any problem in itself. Although normally frowned on for service processes, if you are looking to index system logs at all it is going to need root privelege unless you have been clever with log priveleges, and that can be an equally big minefield.
hi!
it has. but nontheless, the group the splunk process runs as is root (splunk:root). And that's not cool 😕
Check the user Splunk, just run on Linux:
id splunk
and confirm the user has gid=splunk as primary group.