Ray (and all) - I was able to fix this issue today with chmod and still run the agent as 'splunk':
chmod +w /opt/splunkforwarder/etc/system
The error was this:
06-14-2011 16:01:45.163 -0400 ERROR BundlesUtil - Cannot create parent directory: /opt/splunkforwarder/etc/system/metadata: Permission denied
And the root problem was the permissions on the parent directory. It was owned by 'splunk' but wasn't writable:
bash-3.00$ ls -ld /opt/splunkforwarder/etc/system/
dr-xr-xr-x 7 splunk splunk 7 Jun 14 14:44 /opt/splunkforwarder/etc/system/
Hope it works for you too!
Adam
... View more