Splunk Enterprise - "Network daemons not managed by the package system"

[predatorz]

Upgrading Splunk Enterprise using rpm -Uvh <<splunk-installer>>.rpm on RHEL seem to have caused this "Network daemons not managed by the package system" to be flagged out by Nessus (https://www.tenable.com/plugins/nessus/33851)

Notice that for some Splunk Enterprise Instances after upgrade,  there are 2 tar.gz files created in /opt/splunk/opt/packages that cause the below 2 processes to be started by Splunk (pkg-run)

agentmanager-1.0.1+XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.tar.gz
identity-0.0.1-xxxxxx.tar.gz

The 2 processes are started by Splunk user and it will re-spawn if process is killed using kill command
/opt/splunk/var/run/supervisor/pkg-run/pkg-agent-manager2203322202/agent-manager
/opt/splunk/var/run/supervisor/pkg-run/pkg-identity1066404666/identity

How come upgrade of Splunk Enterprise will cause these 2 files to be created or is normal?

[livehybrid · Accepted solution]

Hi @predatorz 

These are just two of many components that make up the Splunk product and presumably abstracted away from Splunkd to prevent a huge monolithic system. The main Spunkd process will launch child processes such as these depending on your configuration and features enabled.

It sounds like Nessus is being overcautious here however if you require confirmation and exactly what the process is doing then I would recommend reaching out to Splunk Support or your Account Team who should be able to help further.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[PickleRick]

Firstly, let me start by stating the obvious - vulnerability scanners are notorious for being way overly trigger-happy with their findings. It takes an experienced person to filter their results and get the actual reasonable results.

Having said that - those processes are spawned by the splunkd process (not directly -  via compsup daemon). So that finding is at least questionable if not simply a false positive.