Getting Data In

Am I breaking any best practices doing a chmod to grant a Splunk user access to Linux log files?

jwalzerpitt
Motivator

I would like to configure Splunk to monitor some log files in var/log and when i go to add data and select the directory I am not seeing all of the logs and the reason is the Splunk user I create does not have rights to see the relevant logs. I was thinking about doing a chmod to grant the Splunk user access to the log files, but if I do that will I breaking any best practices regarding accessing Linux log files?

Thx

Tags (4)
0 Karma
1 Solution

frmaasdam
Path Finder

Two possibilities here:
1. Make user Splunk member of the GID of your logfiles. Group adm? But be sure (regarding a bug) that you start your Splunk instance using su -u splunk -c
2. Or do a setfacl on the requested log files so that user splunk has the rights to execute and read the files.

View solution in original post

jwalzerpitt
Motivator

Thx for the info and options

0 Karma

frmaasdam
Path Finder

Two possibilities here:
1. Make user Splunk member of the GID of your logfiles. Group adm? But be sure (regarding a bug) that you start your Splunk instance using su -u splunk -c
2. Or do a setfacl on the requested log files so that user splunk has the rights to execute and read the files.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>