- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, Splunkers,
I have a doubt. now currently using Splunk enterprise 8.2.5, today morning the etc/password file auto-updated and detected by a third party software ( confidential ).
I never changed the file, so my question is-- does Splunk auto-update the $SPLUNK_HOME/etc/password file?
please provide any Splunk documentation
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

* If you mean passwd file of Linux system (/etc/passwd) - No Splunk does not touch any file outside its the home directory.
* If you mean passwd file of Splunk ($SPLUNK_HOME/etc/passwd) - Splunk stores user information there so if you have done any modification regarding user or role or user-password on Splunk then Splunk might have updated the file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

* If you mean passwd file of Linux system (/etc/passwd) - No Splunk does not touch any file outside its the home directory.
* If you mean passwd file of Splunk ($SPLUNK_HOME/etc/passwd) - Splunk stores user information there so if you have done any modification regarding user or role or user-password on Splunk then Splunk might have updated the file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the quick response
yes i meant $SPLUNK_HOME/etc/passwd
but recently i did not change any user information, roles, password.
but still the file automatically updated itself.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no, i'm not saying it's a problem. i just want to know.
does splunk very often update the password file ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I know User changes (password, name, roles update) could trigger the file to update but not without any reason.
* Check with Splunk support if you think it is happening regularly and without any reason.
* Though I personally have not seen such a bug with any version of Splunk.
