Splunk Deployment Server - Linux /var/log/secure

[RAVISHANKAR]

Hello,

Through deployment server i am able to update inputs.conf on linux client.

I want to ingest /var/log/secure log file - but i am unable to ingest .

If i pass my inputs as /var/log - all logs inside /var/log are getting ingested but /var/log/secure is not getting ingested.

I have another input file through that input file i am able to ingest /var/log/secure but not from splunk deployment server.

Thanks

[livehybrid]

Hi @RAVISHANKAR 

This is likely because of file permissions - Please check out https://splunk.my.site.com/customer/s/article/Splunk-UF-on-Linux-Servers-Can-t-Collect-Audit-Logs-ev... which has a good walkthrough on how to diagnose and resolve this issue. However, these arent changes which can be pushed from the Deployment Server, you will need access to the client server to diagnose and remediate.

Another similar community post which might also help is https://community.splunk.com/t5/Security/Permissions-on-var-log/m-p/25632

Essentially they both relate to the file acl (getfacl/setfacl) to allow the Splunk user to read the files.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[thahir]

HI @RAVISHANKAR ,

Give the read permission to the directory /var/log/secure and try to check again, it may be because of the permission issue the directory is not ingesting.