Security
Highlighted

splunkd.log error message

Path Finder

Hi,

I have this error message repeats twice every 5 seconds in splunkd.log: "ERROR AuthenticationManagerLDAP - Could not find user: abc" Where can I track down this misconfiguration?

thanks!

Tags (1)
Highlighted

Re: splunkd.log error message

SplunkTrust
SplunkTrust

When I have seen this in the past it is because there are entries in the metadata files which are referring to the user. If you search the local.meta files for the username, you should be able to find it. So on a Linux host:

find /opt/splunk/ -name local.meta -exec grep abc {} \; -print

HTH,

Dave

Highlighted

Re: splunkd.log error message

Path Finder

Very Cool! Thank you! I used:

find /opt/splunk -name local.meta -exec grep "abc" {} \; -print
It found the bad user ID.

0 Karma
Highlighted

Re: splunkd.log error message

Esteemed Legend

Be sure to click Accept to close the question.

0 Karma
Highlighted

Re: splunkd.log error message

Motivator

ERROR AuthenticationManagerLDAP - Could not find user="nobody" with strategy="MyLDAPStrategy"
ERROR UserManagerPro - Failed to get LDAP user="nobody" from any configured servers

on RHEL I used this process successfully to remove the above errors that were spamming my splunkd.log:

  1. disabled 'learned' app (adds KO's with user='nobody' as owner)
  2. stop splunk service
  3. look for zombie'd users:

    find /opt/splunk -name local.meta -exec grep -H 'nobody' {} \;^C

  4. replace zombie'd users with 'admin'

    find /opt/splunk -name local.meta -exec sed -i 's/owner = nobody/owner = admin/g' {} \;

  5. start splunk service

Highlighted

Re: splunkd.log error message

Path Finder

Thanks tmarlette ·

0 Karma
Highlighted

Re: splunkd.log error message

Motivator

Cool idea on converting nobody to admin!

If you just want a list of what apps have a nobody in local.meta, try this:

find /opt/splunk/ -name local.meta -exec grep nobody {} \; -print | grep / | sed 's/.*\/apps\///; s/\/metadata\/local.meta//'

0 Karma
Highlighted

Re: splunkd.log error message

Engager

Thanks for the find+sed, very helpful.
But the error for me is

Could not find user "system"

, and there is an owner = splunk-system-user but no owner = system

.

0 Karma
Highlighted

Re: splunkd.log error message

Motivator

Related -- this will find orphaned saved searches/alerts:

| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1 disabled=0 is_scheduled=1
| eval status = if(disabled = 0, "enabled", "disabled")
| fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing
0 Karma
Highlighted

Re: splunkd.log error message

Contributor

The solution to mine was to have all scheduled savedsearches to be owned by a service account / savedsearch runner account.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.