splunkd.log error message

[fuster_j]

Hi,

I have this error message repeats twice every 5 seconds in splunkd.log: "ERROR AuthenticationManagerLDAP - Could not find user: abc" Where can I track down this misconfiguration?

thanks!

[morethanyell]

The solution to mine was to have all scheduled savedsearches to be owned by a service account / savedsearch runner account.

[wrangler2x]

Related -- this will find orphaned saved searches/alerts:

| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1 disabled=0 is_scheduled=1
| eval status = if(disabled = 0, "enabled", "disabled")
| fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing

[dshpritz]

When I have seen this in the past it is because there are entries in the metadata files which are referring to the user. If you search the local.meta files for the username, you should be able to find it. So on a Linux host:

find /opt/splunk/ -name local.meta -exec grep abc {} \; -print

HTH,

Dave

[tmarlette]

ERROR AuthenticationManagerLDAP - Could not find user="nobody" with strategy="MyLDAPStrategy"
ERROR UserManagerPro - Failed to get LDAP user="nobody" from any configured servers

on RHEL I used this process successfully to remove the above errors that were spamming my splunkd.log:

1. disabled 'learned' app (adds KO's with user='nobody' as owner)
2. stop splunk service

3. look for zombie'd users:

   find /opt/splunk -name local.meta -exec grep -H 'nobody' {} \;^C

4. replace zombie'd users with 'admin'

   find /opt/splunk -name local.meta -exec sed -i 's/owner = nobody/owner = admin/g' {} \;

5. start splunk service

[andrewlorien]

Thanks for the find+sed, very helpful.
But the error for me is

Could not find user "system"

, and there is an owner = splunk-system-user but no owner = system

.

[wrangler2x]

Cool idea on converting nobody to admin!

If you just want a list of what apps have a nobody in local.meta, try this:

find /opt/splunk/ -name local.meta -exec grep nobody {} \; -print | grep / | sed 's/.*\/apps\///; s/\/metadata\/local.meta//'

[neelamsantosh]

Thanks tmarlette ·

[fuster_j]

Very Cool! Thank you! I used:

find /opt/splunk -name local.meta -exec grep "abc" {} \; -print
It found the bad user ID.

[woodcock]

Be sure to click Accept to close the question.