I have a need to monitor splunk logs with other applications, therefore I would like to change all (existing and newly created ones) splunk logs' permission from 600(rw- --- ---) to 604(rw- --- r--).
Is there a good way to accomplish this ?
This needs to work for all files, both new and existing.
I have tried setting "umask" etc, but nothing I have tried seems to work.
Any Ideas?
As this only affects the $SPLUNK_HOME/var/log files the following has worked for some customers
If Splunk's official response to this is 'use setfacl' and not "we should be obeying the umask set for the user Splunk runs as", that's pretty awful from a system administrators point of view.
As this only affects the $SPLUNK_HOME/var/log files the following has worked for some customers