Splunk Enterprise

How to Run Universal Forwarder 9.1 as Root?

restinlinux
Explorer

I have changed the permissions of ownership

chown -R  root:root/opt/splunkforwarder

After that, I started Splunk as root user, but after that was finished, the owner:group reverted back to splunk:splunk, respectively. The same situation persists even after restarting Splunk and restarting the OS.

Why its revert back to splunk:splunk

Wanted to operate with root:root as the owner:group under /opt/splunkforwarder.

https://docs.splunk.com/Documentation/Splunk/9.0.1/ReleaseNotes/KnownIssues#Universal_forwarder_issu...

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try this? https://docs.splunk.com/Documentation/Forwarder/9.0.1/Forwarder/Installleastprivileged

Why you want to run it as a root? In security point of view it’s a bad practice and there is no reason for it to get read any files.

r. Ismo

0 Karma

PickleRick
SplunkTrust
SplunkTrust

From the POLP point of view, of course the UF should run with user having finely tuned set of permissions allowing it to only access specific files and so on.

But let's be realistic - it's often easier to run it with just root or LOCAL_SYSTEM (that's how it installs in Windows, BTW) so you don't have to pull your hair out trying to get it to read all necessary inputs and not to break your users/groups.

PickleRick
SplunkTrust
SplunkTrust

But have you enabled the boot start with the root user or splunk user or what? Did you use initd or systemd? (the known issue you point to says about initd but is it really so?).

0 Karma

bapun18
Communicator

@PickleRick wrote:

But have you enabled the boot start with the root user or splunk user or what? Did you use initd or systemd? (the known issue you point to says about initd but is it really so?).


You can use systemd

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I know you can. The question is how it was configured in this case.

0 Karma

bapun18
Communicator

post changing this you can also use sudo /splunkhome/bin/splunk start/status/stop etc
 helps, please accept the solution and karma would be appreciated.

0 Karma

bapun18
Communicator

use splunk-launch.conf under $splunkHome/etc/
use below

SPLUNK_HOME=/opt/splunk

# By default, Splunk stores its indexes under SPLUNK_HOME in the
# var/lib/splunk subdirectory. This can be overridden
# here:
#
# SPLUNK_DB=/home/build/build-home/ember/var/lib/splunk

# Splunkd daemon name

# Splunkweb daemon name
SPLUNK_WEB_NAME=splunkweb

# If SPLUNK_OS_USER is set, then Splunk service will only start
# if the 'splunk [re]start [splunkd]' command is invoked by a user who
# is, or can effectively become via setuid(2), $SPLUNK_OS_USER.
# (This setting can be specified as username or as UID.)
#
# SPLUNK_OS_USER
SPLUNK_SERVER_NAME=Splunkd

then you can use sudo systemctl start/stop/status Splunkd

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check the initd or systemctl script to make sure it's not changing the file ownership.  If that doesn't help then contact support and ask for assistance with the documented issue.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...