Security

splunkd.log error message

fuster_j
Path Finder

Hi,

I have this error message repeats twice every 5 seconds in splunkd.log: "ERROR AuthenticationManagerLDAP - Could not find user: abc" Where can I track down this misconfiguration?

thanks!

Tags (1)

morethanyell
Builder

The solution to mine was to have all scheduled savedsearches to be owned by a service account / savedsearch runner account.

0 Karma

wrangler2x
Motivator

Related -- this will find orphaned saved searches/alerts:

| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1 disabled=0 is_scheduled=1
| eval status = if(disabled = 0, "enabled", "disabled")
| fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing
0 Karma

dshpritz
SplunkTrust
SplunkTrust

When I have seen this in the past it is because there are entries in the metadata files which are referring to the user. If you search the local.meta files for the username, you should be able to find it. So on a Linux host:

find /opt/splunk/ -name local.meta -exec grep abc {} \; -print

HTH,

Dave

tmarlette
Motivator

ERROR AuthenticationManagerLDAP - Could not find user="nobody" with strategy="MyLDAPStrategy"
ERROR UserManagerPro - Failed to get LDAP user="nobody" from any configured servers

on RHEL I used this process successfully to remove the above errors that were spamming my splunkd.log:

  1. disabled 'learned' app (adds KO's with user='nobody' as owner)
  2. stop splunk service
  3. look for zombie'd users:

    find /opt/splunk -name local.meta -exec grep -H 'nobody' {} \;^C

  4. replace zombie'd users with 'admin'

    find /opt/splunk -name local.meta -exec sed -i 's/owner = nobody/owner = admin/g' {} \;

  5. start splunk service

andrewlorien
Engager

Thanks for the find+sed, very helpful.
But the error for me is

Could not find user "system"

, and there is an owner = splunk-system-user but no owner = system

.

0 Karma

wrangler2x
Motivator

Cool idea on converting nobody to admin!

If you just want a list of what apps have a nobody in local.meta, try this:

find /opt/splunk/ -name local.meta -exec grep nobody {} \; -print | grep / | sed 's/.*\/apps\///; s/\/metadata\/local.meta//'

0 Karma

neelamsantosh
Path Finder

Thanks tmarlette ·

0 Karma

fuster_j
Path Finder

Very Cool! Thank you! I used:

find /opt/splunk -name local.meta -exec grep "abc" {} \; -print
It found the bad user ID.

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...