Who is BOSBURN?

[wbfoxii]

I'm getting this error message twice every 30 sec.
12-19-2011 12:15:27.539 -0500 ERROR AuthenticationManagerLDAP - Could not find user: bosburn

I can't figure out where I introduced this user. Our IDs do not use the name format. Did this come in from some app that I installed?

[dwaddle]

BOSBURN is the author of the app. There's apparently still some references in the app to his login ID on his own Splunk install.

You can fix this by editing $SPLUNK_HOME/etc/apps/SEP_Reporting/default/local.meta and replace all instances of owner = bosburn with owner = admin.

And I'm sure someone will nag Brian to fix this and post a new version of the app.

[Brian_Osburn]

DOH! How embarrassing. Almost like discovering that your fly was open all day.

I've uploaded a new version of the application, removing references to my username. Also, my company currently runs SEP 11, which I know isn't the latest version.

[wbfoxii]

Found my answer. It comes from Symantec Endpoint Protection Reporting. The app doesn't really work right anyway. I'm removing it.

Verified that the message is no longer appearing in /opt/splunk/var/log/splunk/splunkd.log