Security

splunkd.log error message

fuster_j
Path Finder

Hi,

I have this error message repeats twice every 5 seconds in splunkd.log: "ERROR AuthenticationManagerLDAP - Could not find user: abc" Where can I track down this misconfiguration?

thanks!

Tags (1)

morethanyell
Builder

The solution to mine was to have all scheduled savedsearches to be owned by a service account / savedsearch runner account.

0 Karma

wrangler2x
Motivator

Related -- this will find orphaned saved searches/alerts:

| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1 disabled=0 is_scheduled=1
| eval status = if(disabled = 0, "enabled", "disabled")
| fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing
0 Karma

dshpritz
SplunkTrust
SplunkTrust

When I have seen this in the past it is because there are entries in the metadata files which are referring to the user. If you search the local.meta files for the username, you should be able to find it. So on a Linux host:

find /opt/splunk/ -name local.meta -exec grep abc {} \; -print

HTH,

Dave

tmarlette
Motivator

ERROR AuthenticationManagerLDAP - Could not find user="nobody" with strategy="MyLDAPStrategy"
ERROR UserManagerPro - Failed to get LDAP user="nobody" from any configured servers

on RHEL I used this process successfully to remove the above errors that were spamming my splunkd.log:

  1. disabled 'learned' app (adds KO's with user='nobody' as owner)
  2. stop splunk service
  3. look for zombie'd users:

    find /opt/splunk -name local.meta -exec grep -H 'nobody' {} \;^C

  4. replace zombie'd users with 'admin'

    find /opt/splunk -name local.meta -exec sed -i 's/owner = nobody/owner = admin/g' {} \;

  5. start splunk service

andrewlorien
Engager

Thanks for the find+sed, very helpful.
But the error for me is

Could not find user "system"

, and there is an owner = splunk-system-user but no owner = system

.

0 Karma

wrangler2x
Motivator

Cool idea on converting nobody to admin!

If you just want a list of what apps have a nobody in local.meta, try this:

find /opt/splunk/ -name local.meta -exec grep nobody {} \; -print | grep / | sed 's/.*\/apps\///; s/\/metadata\/local.meta//'

0 Karma

neelamsantosh
Path Finder

Thanks tmarlette ·

0 Karma

fuster_j
Path Finder

Very Cool! Thank you! I used:

find /opt/splunk -name local.meta -exec grep "abc" {} \; -print
It found the bad user ID.

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...