On what user does splunk start after restarting it from deployment server

[ankithreddy777]

Hi,
When we restart splunk forwarder from deployment -server does it start
1) based on user defined in boot script OR
2) Based on the UserId under which is installed.

Suppose Splunk is installed under user "splunk" and boot script is defined to start as root user.

So when Splunk restarted by DS, does it run as root or splunk user .

[gjanders]

As per somesoni2's comment the process will fork a new process with the same userid to restart Splunk, it cannot change the username it was running as previously unless it's the root user.

If it was running as root and you updated /opt/splunk/etc/splunk-launch.conf to have the line:

SPLUNK_OS_USER=splunk

Or similar, then it will restart as the splunk user, however this is an edge case as you would have to have it running as root, then change the file while it's running before the deployment server triggered a restart...

[somesoni2]

It'll be restarted with same user with which it was running before it downloaded app/configuration from DS.

[gjanders]

As per somesoni2's comment (which could be an answer), the process will fork a new process with the same userid to restart Splunk, it cannot change the username it was running as previously unless it's the root user.

If it was running as root I'm unsure if it will attempt to run as a different user post-restart, that might be worth testing if you have the user setting configured in the splunk-launch.conf file!