Deployment Architecture

Centos 7 - Splunk 7.4.2 - Enable/Disable boot start - issues as non-root user

ehqtrainorm
Explorer

We have setup "enable boot-start" as the non-root user "splunk" and it's not systemd managed:
/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes

From what I have read, this changes the SPLUNK_OS_USER in splunk-launch.conf, as well as creates a new init.d script. However, according to this document, you still need to edit the init.d script to run splunkd as a non-root user. I would have thought that specifying "-user splunk" would have been enough to ensure this happened.

So can you please verify that, in order to properly run splunk as non-root user and for splunk to start at boot, you need to:

  1. Enable boot-start as per the command above;
  2. Edit the init.d script to ensure that the commands are being run as the appropriate non-root user.

I ask this because this makes maintenance a bit more tricky. Say I want to disable boot-start. This deletes the init.d script apparently. Then when we run the enable boot-start command again, the file is re-created, without our edits. So we need to edit the file again. Failing to do so could cause issues when splunk is started on boot as root rather than the non-root user.

ivanreis
Builder

All the times that I have to enable it at boot, I used the root id to run the command "/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes". This command already add the line to init.d when you run it under root. Maybe if you want to disable it, it would be better you sudo root and only comment the line for boot start.

Check this answer -> https://answers.splunk.com/answers/724473/major-boot-start-change-with-723-1.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...