Splunk Enterprise

Would you show steps on how to check / fix file integrity check errors on Splunk Ent. / ES

SamHTexas
Builder

How to check / fix file integrity check errors on Splunk Ent. / ES. Thank u

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk will find the files for you.  When it finds one you should see a message in the Messages dropdown.  Click on it for details.  The fix is to replace the file with the one from the installation tarball.

---
If this reply helps you, an upvote would be appreciated.

SamHTexas
Builder

Thank u sir for your message. The only description I found under check results column says " differs". So how severe of an issue is it sir not to deal with such errors? It seems like this error comes & goes (error goes away) from one server to another every few days. Thank u again.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

"Differs" is all Splunk can say because it's just comparing the current hash value of the file to that which it has on record.  To find the actual difference, you'd have to compare it to a known-good copy of the file (from the tarball or your backup).

Usually, a difference is not an issue, but that depends on the actual change(s) in the file.  Perhaps someone added a custom format to datetime.xml or maybe they screwed it up and some timestamps will fail to match.

I don't know why the issue would come and go.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!