Splunk Enterprise

Splunk User Getting Permission Denied In Linux

OgoSplunk
Path Finder

Hi,

I heard that it's frowned upon to run Splunk on the root so I created a Splunk User. I can't figure out why I can't run Splunk start, stop, and status without getting permission denied. I've changed the ownership to for /opt/splunk to the user "Splunk" that I've created because I was told it was bad to run Splunk as root.  When working in my "Splunk" user account I continuously get this error whenever trying to config enable boot-start splunk.

oot@cluster-master:/opt# ./splunk/bin/splunk enable boot-start -systemd-managed 1 -user splunk

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Systemd unit file installed at /etc/systemd/system/Splunkd.service.
Configured as systemd managed service.
root@cluster-master:/opt# su splunk
splunk@cluster-master:/opt$ ./splunk/bin/splunk status

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
splunkd.pid file is unreadable.
Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied
splunk@cluster-master:/opt$

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The enable boot-start command must be run as root because it modifies system files. You either can switch to the root user to run the command or use sudo. See https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boo...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The enable boot-start command must be run as root because it modifies system files. You either can switch to the root user to run the command or use sudo. See https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boo...

---
If this reply helps you, Karma would be appreciated.

OgoSplunk
Path Finder

@richgalloway Step 6 wants me to edit a file using nano or any text editor but I don't see the file there /splunk/etc/init.d/splunk could you help me out with this last part? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That file is created in Step 3, but only on systems not running systemd.  However, given the output in the OP, I believe you should be following the steps in the "Enable boot-start on machines that run systemd" section.

---
If this reply helps you, Karma would be appreciated.

OgoSplunk
Path Finder

@richgalloway you're the GOAT( GREATEST OF ALL TIME). I'll pass on the Karma now 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...