Is it mandatory to create the "splunkfwd" user for Universal Forwarder 9.4.0 or higher version

[Nraj87]

The splunkfwd user is created by default in version 9.1, and seeing the warning "User splunkfwd does not exist - using root" while upgrade.

the upgrade guide does not say that creating the splunkfwd user is mandatory for Universal Forwarder installations or upgrades.

Upgrade the universal forwarder | Splunk Docs
"When you upgrade, the RPM/DEB package installer retrieves the file owner of SPLUNK_HOME/etc/myinstall/splunkd.xml. If a previous user exists, the RPM/DEB package installer will not create a splunkfwd user and instead will reuse the existing user. If you wish to create a least privileged user, that is, the splunkfwd user, you must remove the existing user first."


the warning appears during the upgrade regarding the missing splunkfwd user, there are no permission issues, and the forwarder is functioning properly with "splunk" User.

Appreciate your guidance on whether it is mandatory to create the splunkfwd user for Universal Forwarder9.4.0 or higher version?

Note: in this topic Splunk enterprise and Splunk UF not installed on the same machine

[isoutamo]

Hi

You should always have separate user for running UF on any box. What this user name should be and is it local or centrally managed depends on your company's policies. Anyhow it should be something else than root!

Earlier that user was splunk as also in enterprise. In some phases it has changed to splunkfwd. I'm not sure if it's currently again splunk or still splunkfwd. 

If/when you are using your OS's package manager to install Splunk UF then it creates that user and usually you don't need to take care of it. But when you are using tar.gz package and install it manually or with some scripts, you must create that OS level user by yourself.

The most important task is check that this user owns all files under SPLUNK_HOME and the correct OS user name is used in enable boot startup settings! Basically this user name can be what ever you want, but if/when you are using something else than those default you must do chown -R always after you have update UF version!

With earlier splunk versions you must grant access for this user to your monitored log files. Currently this is not needed if/when you are using systemd start scripts. It this change good or not is another story?

You could look more:

• https://splunk.my.site.com/customer/s/article/Universal-Forwarder-is-able-to-ingest-files-that-it-do...
• https://community.splunk.com/t5/Installation/Security-issue-Splunk-UF-v9-x-is-re-adding-readall-capa...
• https://help.splunk.com/en/splunk-enterprise/forward-and-process-data/universal-forwarder-manual/9.3...

r. Ismo