Getting Data In

When trying to start Splunk, I'm getting an "execve: Permission denied" error. How can I fix this?

DerekB
Splunk Employee
Splunk Employee

Trying to start Splunk but getting an "execve: Permission denied " error

This is Splunk 6.1.x and my OS is AIX.

bin/splunk start --accept-license

Checking prerequisites...
WARNING: File size limit (ulimit -f) is set low (1073741312 bytes) Splunk may not work.
You may want to run "ulimit -f unlimited" before starting splunk.
Checking mgmt port [8089]: open
Creating: /opt/splunkforwarder/var/lib/splunk
Creating: /opt/splunkforwarder/var/run/splunk
Creating: /opt/splunkforwarder/var/run/splunk/appserver/i18n
Creating: /opt/splunkforwarder/var/run/splunk/appserver/modules/static/css
Creating: /opt/splunkforwarder/var/run/splunk/upload
Creating: /opt/splunkforwarder/var/spool/splunk
Creating: /opt/splunkforwarder/var/spool/dirmoncache
Creating: /opt/splunkforwarder/var/lib/splunk/authDb
Creating: /opt/splunkforwarder/var/lib/splunk/hashDb
New certs have been generated in '/opt/splunkforwarder/etc/auth'.
Checking conf files for problems...
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
execve: Permission denied

1 Solution

DerekB
Splunk Employee
Splunk Employee

The problem here is that splunk was configured with boot start enabled. On AIX, this will put a line in the /etc/inittab file which will then be run by startsrc. This seems fine except startsrc is run by root and if your Splunk install is configured to run as a different user, you can get a "permission denied" error.

To fix this, remove the line in /etc/inittab that references Splunk and restart.

If you do want Splunk to start at boot time, you could configure it with the "enable boot start" but just make sure to set the user Splunk will run as correctly. This doc page is a good reference.

http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/ConfigureSplunktostartatboottime

View solution in original post

DerekB
Splunk Employee
Splunk Employee

The problem here is that splunk was configured with boot start enabled. On AIX, this will put a line in the /etc/inittab file which will then be run by startsrc. This seems fine except startsrc is run by root and if your Splunk install is configured to run as a different user, you can get a "permission denied" error.

To fix this, remove the line in /etc/inittab that references Splunk and restart.

If you do want Splunk to start at boot time, you could configure it with the "enable boot start" but just make sure to set the user Splunk will run as correctly. This doc page is a good reference.

http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/ConfigureSplunktostartatboottime

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...