I get these errors when trying to check the status of SPLUNK after a restart of the device:
Pid file "/trvapps/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission de nied
Cannot initialize: /trvapps/splunk/etc/system/metadata/local.meta: Permission de nied
Cannot initialize: /trvapps/splunk/etc/system/metadata/local.meta: Permission de nied
Cannot initialize: /trvapps/splunk/etc/system/metadata/local.meta: Permission de nied
Pid file "/trvapps/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission de nied
splunkd.pid file is unreadable.
Pid file "/trvapps/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission de nied
It looks like you are running splunk as X user and you are trying to check splunk status with Y user and Y user does not have permission to read those files/directory created by X user so you are getting this error.
I found that the files in question had root:root as owner. I changed to splunk and I was able to run the command okay.
Can someone tell me how these got set to root?
Thanks!
Great, you found the issue. Have you enabled splunk boot start using command $SPLUNK_HOME/bin/splunk enable boot-start
? If yes then server will start splunk during server boot as root user. If you need to start splunk as spunk user during server boot then run command $SPLUNK_HOME/bin/splunk enable boot-start -user splunk
as root user which will modify boot script and due to vulnerability in this one you need to modify boot script as well. For more detailed documentation please refer https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/ConfigureSplunktostartatboottime
Thanks, I went back through my procedures and found that when I originally installed I didn't have the -user splunk argument. I have since added that.
Thanks!
It looks like you are running splunk as X user and you are trying to check splunk status with Y user and Y user does not have permission to read those files/directory created by X user so you are getting this error.