Deployment Architecture

IOError: [Errno 13] Permission denied

843359
Explorer

Hi there! I was trying to access log files from a remote drive. After failing to index any content from the directory on the network, I then tried to run services "Splunkd" and "Splunkweb" as a user with the access to the remote drive.

After restarting the services, I encountered following error while starting Splunk:

IOError: [Errno 13] Permission denied: 'C:\Program Files\Splunk\var\run\splunk\session-a22699a0d534352c044d5ba6c1f30753cbe4bb71.lock'

I have checked this thread: http://www.splunk.com/support/forum:SplunkGeneral/3163
while gkanapathy stated at last that "I will note that if you change the userid of the splunkweb and splunkd services, you will probably encounter a bunch of file permissions and access problems on the local Splunk installation (e.g., can't get to it's own program and config and temp files), and you'd have to go and change all those."

I am wondering which exactly changes can be applied according to this scenario?

Thanks a lot in advance.

Tags (1)
0 Karma
1 Solution

Drainy
Champion

Have you tried deleting the lock file? It just locks the session, if Splunk doesn't have access to it then it won't be able to remove it.

Essentially you need the user that is running splunk to be able to have access to all of the splunk configs inside splunk\etc\apps and splunk\etc\system.
That would mean changing them to the user that you are running Splunk as.
You could also change the permission to the lock file to the current user to allow it access to handle it itself.

View solution in original post

Drainy
Champion

Have you tried deleting the lock file? It just locks the session, if Splunk doesn't have access to it then it won't be able to remove it.

Essentially you need the user that is running splunk to be able to have access to all of the splunk configs inside splunk\etc\apps and splunk\etc\system.
That would mean changing them to the user that you are running Splunk as.
You could also change the permission to the lock file to the current user to allow it access to handle it itself.

843359
Explorer

Thanks very much for the kind help =D

Drainy
Champion

Right click on the file, properties, click on the Security tab at the top, click edit, from here you can modify the permissions of existing users or add users
Be careful about playing around with existing permissions unless its to provide a specific user with permission to a file.
Bear in mind that groups can be on here so you could accidentally give a group full permissions instead of a user if they have similar names 🙂

843359
Explorer

Thanks a lot, deleting the lock file does fix this issue. But, how do I change the permission to the lock file to the current user?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...