Security

How to change permissions on Splunk log files?

dshakespeare_sp
Splunk Employee
Splunk Employee

I have a need to monitor splunk logs with other applications, therefore I would like to change all (existing and newly created ones) splunk logs' permission from 600(rw- --- ---) to 604(rw- --- r--).
Is there a good way to accomplish this ?

This needs to work for all files, both new and existing.
I have tried setting "umask" etc, but nothing I have tried seems to work.

Any Ideas?

Tags (3)
1 Solution

dshakespeare_sp
Splunk Employee
Splunk Employee

As this only affects the $SPLUNK_HOME/var/log files the following has worked for some customers

  1. "splunk stop"
  2. chmod -R 604 <$SPLUNK_HOME/var/log/splunk> (change existing file)
  3. setfacl -Rmd:other:r <$SPLUNK_HOME/var/log> (set ACLs on directory so all new files are created 604)
  4. "splunk start"

View solution in original post

jmackie
Engager

If Splunk's official response to this is 'use setfacl' and not "we should be obeying the umask set for the user Splunk runs as", that's pretty awful from a system administrators point of view.

dshakespeare_sp
Splunk Employee
Splunk Employee

As this only affects the $SPLUNK_HOME/var/log files the following has worked for some customers

  1. "splunk stop"
  2. chmod -R 604 <$SPLUNK_HOME/var/log/splunk> (change existing file)
  3. setfacl -Rmd:other:r <$SPLUNK_HOME/var/log> (set ACLs on directory so all new files are created 604)
  4. "splunk start"
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...