Hello,
We decided to run Splunk (Windows) with a MSA (Managed Service Account) with the Minimum permissions requirements from this documentation :
https://docs.splunk.com/Documentation/Splunk/7.3.2/Installation/ChoosetheuserSplunkshouldrunas
This is the privileges we gave to this account :
Required basic permissions for the splunkd or splunkforwarder services
Full control over the Splunk Enterprise installation directory.
Read access to any files that you want to index.
Required Local/Domain Security Policy user rights assignments for the splunkd or splunkforwarder services
Permission to log on as a service.
Permission to log on as a batch job.
Permission to replace a process-level token.
Permission to act as part of the operating system.
Permission to bypass traverse checking.
So far, it works well. Also, we gave the MSA the "Modify" rights on the whole Splunk folder. Only, there is one problem :
Since we run it as MSA, we get this error :
ERROR IntrospectionGenerator:resource_usage - RU - Splunk was started with insufficient privileges to collect resource usage metrics. Please modify the service properties to run with Administrator privileges. Exiting.
I've search everywhere, and no one seems to have this error on the web. Is there some documentation explaining the context of this error? Is there some privileges not shown from the Splunk documentation that are missing?
Also, I've noted that the "/var/log/introspection/resource_usage.log" file stopped being fulfill as soon as we activated the MSA.
Thanks in advance
[1]: https://docs.splunk.com/Documentation/Splunk/7.3.2/Installation/ChoosetheuserSplunkshouldrunas
↧