Splunk Enterprise

how to give splunk user in Linux UF to read /var/log/messages.log - permission denied

radam2000
Path Finder

redhat 7

created a splunk user in linux - added user to wheel group and sudoers

Installed splunk UF for linux 7.3.7.1
all files chown splunk:splunk

configured splunk to runas splunk user
all successfull - ps shows splunk pids as splunk user even if started from root...

as splunk user
go to var/log/

-rw-r--r--. 1 root root 57814 Mar 5 11:17 tftpd.log
-rw-------. 1 root root 1810830 Mar 5 12:00 kern.log
-rw-------. 1 root root 1534866879 Mar 5 13:54 user.log
-rw-r--r--. 1 root root 411594197 Mar 5 15:45 mrtg.log
-rw-------. 1 root root 161108311 Mar 5 15:46 cron.log
-rw-------. 1 root root 38312402 Mar 5 15:46 secure.log
-rw-------. 1 root root 249091058 Mar 5 15:46 daemon.log
-rw-------. 1 root root 1578879854 Mar 5 15:47 messages.log

as splunk user I can't tail -10 messages.log or secure.log - permission denied
if i sudo tail -10 then i can read these files and displayed...
setup  Splunk_TA_nix and local/inputs.conf - monitor for secure.log and messages.log - get splunk UF error in splunkd.log - permission denied...

What do I need to do to make this work properly as splunk user...
can't add sudo to inputs.conf monitor command... so splunk user needs read rights to these files in /var/log for TA_nix to work properly

Suggestions welcome please.... thanks in advance... Rich

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the setfacl command to give splunk user access to the monitored files.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use the setfacl command to give splunk user access to the monitored files.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...