Deployment Architecture

How to set automatically executable attribute of file in Splunk for Unix and Linux technology add-on

sieutruc
Contributor

Hello,

When i deploy Splunk for Unix TA by using deployment server, after client downloaded that app, it could't run immediately all the executable files because it hasn't enough right to do, i have to change the attributes (executable bit) of all files in ../bin/[scriptName].sh manually.
So do you know how to setup those attributes from deployment server, by which Universal Forwarder can run without touching anymore configuration files ?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Is your deployment server Windows? I'm guessing it is. My unix deployment servers don't have this issue. The Windows NTFS filesystem has no understanding of the execute-bit on files, and it is probably getting lost in translation between the two. I'm not sure there is a good solution here, and would recommend you reach out to Splunk support. Or, move your deployment server to a Linux host...

dwaddle
SplunkTrust
SplunkTrust

When an app is deployed by deployment server, the relevant permissions settings from the source-app in $SPLUNK_HOME/etc/deployment-apps are effectively copied. (Some things, like setuid are probably not, but let's leave those out.) If the permissions are correct on the deployment server's copy of the app, they should be correct on each deployment client. You may need to "force" the deployment clients to re-pull the app, by doing something like a blank line at the end of a .conf file, then doing a splunk reload deploy-server.

0 Karma

sieutruc
Contributor

No, i did all of them on Linux hosts (Open Suse). I copied Splunk add-on to deployment server and copied inputs.conf from default to local. After that, when i saw Splunkd.log, it said that those such scripts couldn't run. I went into the folder and chmod 744 and then it worked .
So if i do chmod in deployment server, won't client need to change attribute manually ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...