Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About batemanj
batemanj
New Member
Member since:
10-29-2019
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-29-2019 |
Activity Feed
- Posted where does splunk store output of shell scripts? on Splunk Search. 11-16-2019 03:28 AM
- Tagged where does splunk store output of shell scripts? on Splunk Search. 11-16-2019 03:28 AM
- Posted Re: Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-31-2019 10:43 AM
- Posted Re: Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-30-2019 09:37 PM
- Posted Re: Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-30-2019 08:42 PM
- Posted Re: Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-29-2019 10:59 AM
- Posted Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-29-2019 09:31 AM
- Tagged Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-29-2019 09:31 AM
- Tagged Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-29-2019 09:31 AM
- Tagged Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-29-2019 09:31 AM
- Tagged Unable to run "enable boot-start" as root user on RHEL 6.10 on Deployment Architecture. 10-29-2019 09:31 AM
Topics I've Started
11-16-2019
03:28 AM
Hi,
On Splunk forwarders, we have few shell scripts in "SPLUNK_HOME/etc/apps/my_app/bin/" that are being run. Just wondering where do the outputs of these shell scripts store? Shell scripts don't have the output filename in them so I tried to look into "SPLUNK_HOME/var/log/splunk" but no luck. Are these outputs store in "*.dat" file which we can't read?
Thanks
... View more
- Tags:
- splunk-enterprise
10-31-2019
10:43 AM
Thanks agian codebuilder. I run as full root (not sudo).
As I can't run splunk as root, I added "sudo -H -u splunk" in /etc/init.d/splunk so that both commands you asked for are running fine. Prior to these changes, those commands did not work. Please see below:
[root@TESTSVR ~]# getenforce
Permissive [root@TESTSVR ~]#
[root@TESTSVR ~]# id uid=0(root)
gid=0(root)
groups=0(root),500(sapinst)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[root@TESTSVR ~]# [root@TESTSVR ~]#
time service splunk status Splunk
status: splunkd is running (PID:
5305). splunk helpers are running
(PIDs: 5311).
real 0m0.194s user 0m0.049s sys
0m0.121s [root@TESTSVR ~]#
[root@TESTSVR ~]# time
/etc/init.d/splunk status Splunk
status: splunkd is running (PID:
5305). splunk helpers are running
(PIDs: 5311).
real 0m0.147s user 0m0.048s sys
0m0.087s [root@TESTSVR ~]#
[root@TESTSVR ~]# time
/opt/splunkforwarder/bin/splunk status
^C
real 0m13.854s user 0m0.001s sys
0m0.002s [root@TESTSVR ~]#
[root@TESTSVR ~]# grep splunk
/etc/init.d/splunk |grep -i status
splunk_status() { /usr/bin/sudo -H
-u splunk bash -c '/opt/splunkforwarder/bin/splunk
status'
splunk_status [root@TESTSVR ~]#
... View more
10-30-2019
09:37 PM
[root@TestBox etc]# grep SPLUNK_OS_USER /opt/splunkforwarder/etc/splunk-launch.conf |grep -vi "^#"
SPLUNK_OS_USER=splunk
[root@TestBox etc]# df -Ph /opt
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/volgroup01-lv_root 13G 6.0G 6.1G 50% /
[root@TestBox etc]# ls -ltra /opt |grep -i splunk
drwxr-xr-x. 9 splunk splunk 4096 Oct 31 01:27 splunkforwarder
[root@TestBox etc]#
I ran "strace" while running "/opt/splunkforwarder/bin/splunk" as root and it reads sockets of winbind (weirdly) but when I run it as splunk user, it reads only "/opt/splunkforwarder/" files.
... View more
10-30-2019
08:42 PM
Thanks codebuilder for your reply.
I'm not sure if I conveyed my problem correctly here but we have problem running as root where everything works fine as "splunk user". Please please read my OP. however I checked all your pointers and all OK.
[root@TestBox etc]# grep
SPLUNK_OS_USER
/opt/splunkforwarder/etc/splunk-launch.conf
|grep -vi "^#" SPLUNK_OS_USER=splunk
[root@TestBox etc]# df -Ph /opt
Filesystem Size
Used Avail Use% Mounted on
/dev/mapper/volgroup01-lv_root 13G
6.0G 6.1G 50% / [root@TestBox etc]# ls -ltra /opt |grep -i splunk
drwxr-xr-x. 9 splunk splunk 4096
Oct 31 01:27 splunkforwarder
[root@TestBox etc]#
I ran "strace" while running "/opt/splunkforwarder/bin/splunk" as root and it reads sockets of winbind (weirdly) but when I run it as splunk user, it reads only "/opt/splunkforwarder/" files.
... View more
10-29-2019
10:59 AM
Hi woodcock,
Thanks for the reply but my RHEL version is still 6.10 (not RHEL 7) and there is no systemd in RHEL6.
Please notice that my problem is just that root is unable to run "/opt/splunkforwarder/bin/splunk" on few RHEL 6 machines.
... View more
10-29-2019
09:31 AM
Hi,
We installed/configured Splunk Universal forwarder 7.2.3 on hundreds of RHEL 6.10 in our environment and all of them working perfectly fine. There're few machines with selinux enabled with "permissive" mode. None of them are in "Enforcing" mode (thankfully).
Within these selinux (permissive mode) machines, only a few of them we were able to install/configure Splunk without any issues but on remaining machines we observed strange behavior.
After extracting the package, assigning ownership etc. we are able to set up the forward with sudo -H -u splunk /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt and splunk starts successfully and communicates with Splunk Server but when I try to run /opt/splunkforwarder/bin/splunk enable boot-start -user splunk " as root user it simply stucks/hangs and the only way is to stop it by pressing ctrl-C or close the putty session. So basically root user is unable to run /opt/splunkforwarder/bin/splunk either for setup/start/stop, it just hangs. But both setup/start/stop work fine when we run as "splunk" user. With this behavior we are unable to run "enable boot-start" and weirdly this is happening only on few RHEL 6.10 servers with selinux permissive mode (not on all). Wondering if there's any additional security that causing this behavior of stopping root /opt/splunkforwarder/bin/splunk
I know we can do this boot-start part manually by creating a startup script in init.d which i would like to discuss later.
I appreciate any help, thanks!!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
