All Apps and Add-ons

ossec app: ERRORFilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/active-responses.log": Permission denied

dshakespeare_sp
Splunk Employee
Splunk Employee

Customer reports issues monitoring ossec log files with Splunk, using the ossec app splunkd.log reports

07-21-2013 11:31:53.250 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/active-responses.log": Permission denied
07-21-2013 11:31:53.251 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/alerts": Permission denied
07-21-2013 11:31:53.253 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "/var/ossec/logs/ossec.log": Permission denied

Splunk is installed as user splunker, and splunker has read access to the files. The files and directory path have full read access though the whole directory tree. getfacl also shows full read permissions

0 Karma
1 Solution

dshakespeare_sp
Splunk Employee
Splunk Employee

The issues was resolved by adding the user splunker to the ossec group using "usermod -a -G ossec splunker" and restarting splunk

View solution in original post

crash1011
Explorer

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors
09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied
Then I found this actually did work:
- Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK
- Do a splunk list monitor (if you’ve got the same problem it won’t be listed)
- Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart
- Do another splunk list monitor to see if it has worked

Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server

dshakespeare_sp
Splunk Employee
Splunk Employee

The issues was resolved by adding the user splunker to the ossec group using "usermod -a -G ossec splunker" and restarting splunk

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...