Splunk Enterprise

Why permission error after upgrade during restart?

jljackson3
Observer

Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied: '/opt/splunk/etc/system/local/authentication.conf.migratepreview'

 

Unable to restart Splunk after upgrade

Labels (2)
Tags (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What system is this? I assume this is some flavor of linux. Which distribution? How did you do the upgrade? (rpm? deb? tgz?) How was the original system installed?

 

0 Karma

JyPl4wNYu7GV1uL
Engager

Similar has happened to me for my last 2 upgrades (9.0.5 and 9.1.0.2).  In both cases after the upgrade, some conf files end up with root:root ownership.  Before the upgrade they were splunk:splunk.

Offending files (plus 1 .pyc file and migration.log in var/log/splunk):

etc/system/local/eventtypes.conf

etc/system/local/web-features.conf

etc/system/local/authorize.conf

Primary concern are the conf files.  The upgrade is by .tgz file run as splunk:splunk.  The initial start is run by root cuz it needs root permissions to create the systemd boot-start file.  Is this just going to keep happening since I need to run "splunk enable boot-start . . . " as root?
It's not a big deal to run chown to fix everything, but it is a manually step when is sometimes forgotten.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Things don't happen by themselves usually. You must have sone something as root so that resulting files ended up being owned by root.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Make sure you performed the upgrade as the right user (the owner of Splunk as opposed to root).  Ensure all files in $SPLUNK_HOME are owned by the user running Splunk.

---
If this reply helps you, Karma would be appreciated.

jljackson3
Observer

I have inherited this system and the original owner is no longer with us.

How do I determine which account to use?

Is it better to uninstall and reinstall?

 

0 Karma

GaetanVP
Contributor

If Splunk is running : you can find the user running Splunk using 

ps -aux | grep -i Splunk

And find which user is running the process

If Splunk is not running : you can check who owns the $SPLUNK_HOME folder (usually under /opt/splunk)

As @richgalloway mentioned, you can try this command o be sure the user that will run Splunk has the ownership of the install path :

chown -R <user_meant_to_run_splunk> /opt/splunk

 

Good luck!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...