Running Splunk 9.3.5 on RHEL 8.  STIG hardened environment.  The non-Splunk RHEL instances running a Universal Forwarder have no issue access the audit.log files, apparently by virtue of the statement AmbientCapabilities=CAP_DAC_READ_SEARCH located in the /etc/systemd/system/SplunkForwarder.service file.  However, the same is not true on the Splunk instance.  They require read access permissions via a file ACL or something.  Where these options all result in multiple STIG compliance findings.  Which each require write ups a vendor (Splunk) dependencies.   Question - why?  Why can't Splunk access the audit.log files the same way as the UF?  Or is there some way to do the same sort of thing with AmbientCapabilities for Splunkd.Service? It is tempting to quit collecting these logs with Splunk itself and install UF on the Splunk instances too. ... View more