Splunk Enterprise

Splunk Deployment Server - Linux /var/log/secure

RAVISHANKAR
Loves-to-Learn Lots

Hello,

Through deployment server i am able to update inputs.conf on linux client.

I want to ingest /var/log/secure log file - but i am unable to ingest .

If i pass my inputs as /var/log - all logs inside /var/log are getting ingested but /var/log/secure is not getting ingested.

I have another input file through that input file i am able to ingest /var/log/secure but not from splunk deployment server.

Thanks

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @RAVISHANKAR 

This is likely because of file permissions - Please check out https://splunk.my.site.com/customer/s/article/Splunk-UF-on-Linux-Servers-Can-t-Collect-Audit-Logs-ev... which has a good walkthrough on how to diagnose and resolve this issue. However, these arent changes which can be pushed from the Deployment Server, you will need access to the client server to diagnose and remediate.

Another similar community post which might also help is https://community.splunk.com/t5/Security/Permissions-on-var-log/m-p/25632

Essentially they both relate to the file acl (getfacl/setfacl) to allow the Splunk user to read the files.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

thahir
Contributor

HI @RAVISHANKAR ,

Give the read permission to the directory /var/log/secure and try to check again, it may be because of the permission issue the directory is not ingesting.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...