Monitoring Splunk

Error adding SSHFS mount as a data input

frank_h
New Member

on a mac os x server, I am trying to add a directory as input. I encounter the following error when trying to save the Monitor

"Encountered the following error while trying to save: In handler 'monitor': Path is not readable."

the path is /Volumes/wliprod02, and I can access this path as my local admin user. The volume is mounted via sshfs.

splunkd is running as root user. so it should have access.. I cant see any error being logged to splunkd.log in conjunction with that

Not sure what is wrong, any insight is appreciated!

Tags (2)
0 Karma

hexx
Splunk Employee
Splunk Employee

One of the things to check when feeding Splunk an SSHFS mount to monitor is that the underlying mount point directory also has adequate ownership/permissions.

We have seen instances where the directories traversed were all showing the expected owner/permissions with the SSHFS share mounted (root:root/750 for example) but Splunk was unable to monitor the files in the share because the underlying mount point belonged to a different user.

This will show up in $SPLUNK_HOME/var/log/splunkd.log in the following way :

splunkd.log:06-27-2010 11:37:02.229 INFO TailingProcessor - Parsing configuration stanza: monitor:///var/log/sshfs_mountpoint. splunkd.log:06-27-2010 11:37:02.229 WARN FilesystemChangeWatcher - error getting attributes of path "/var/log/sshfs_mountpoint": Permission denied

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...