- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Does changing of logs permissions require a forwar...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the files/directories are not accessible, Splunk will drop them from it's monitoring list and will not be monitored till it restart again (when it'll re-evaluate the monitoring list again, same behavior happens with IgnoreOlderThan attribute.), so yes, it's expected.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the files/directories are not accessible, Splunk will drop them from it's monitoring list and will not be monitored till it restart again (when it'll re-evaluate the monitoring list again, same behavior happens with IgnoreOlderThan attribute.), so yes, it's expected.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, is it a feature or a bug? It seems to me that if permissions are changed, the forwarder has to pick up these changes at some point without being bounced.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's neither a feature nor bug, its just how it works. You can submit a p4 enhancement request if you think there is a room for improvement.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fair enough. To me it's obviously a bug. There is a problem of how an admin can detect that permissions were changed. We have constant issues with that and only after major commotions, like today, we fix these issues by bouncing. How me, as an admin, can detect something like that?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to detect any of these underlying OS changes in the Splunk logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Things like access denied should be logged in the splunkd log of the forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's great - so we might need "just" an alert based on this logging..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree, its pain when you have hundreds if not thousands of forwarders managing and requesting permissions for the files to the id that splunk forwarder is running as. We were in the same situation and came a long way since we have convinced our management to let our Splunk forwarders run as root. Which made things lot easier.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh man - I don't like this solution at all ; -) it just illustrates what a software limitation/bug forces us to do.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there maybe anything like http://<host>:8000/en-US/debug/refresh for the forwarder?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You may try this CLI command
$Splunk_Home/bin/splunk _internal call /configs/conf-inputs/_reload
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Interesting
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
