Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Splunk forwarder on Linux - ./splunk "commands" just hang

$
0
0
It has been a while since I have worked with Linux, but doing my best to refresh my knowledge. Successfully installed the latest forwarder on Ubuntu and it has actually phoned home and the deployment server has pushed config to it. But now it has stopped working. I have configured it to run as user 'splunk', not as root. This has caused some issue, for instance when I just now did run splunk@myserver:~$ ./bin/splunk display deploy-client Pid file "/opt/splunkforwarder/var/run/splunk/splunkd.pid" unreadable.: Permission denied Pid file "/opt/splunkforwarder/var/run/splunk/splunkd.pid" unreadable.: Permission denied Operation "ospath_fopen" failed in /opt/splunk/src/libzero/conf-mutator-locking.c:337, conf_mutator_lock(); Permission denied Did sudo to root and /opt/splunkforwarder# chown -R splunk:splunk * Error did go away, but now when running the same command (as Splunk) nothing happens. I must CTRL+C to "get out of it" splunk@myserver:~$ ./bin/splunk display deploy-client ^C splunk@myserver:~$ Most likely more a basic Linux quesiton, but still, anyone who has an idea of what could be wrong? *Update* And now I did try splunk@myserver:~$ ./bin/splunk list forward-server Cannot initialize: /opt/splunkforwarder/etc/apps/learned/metadata/local.meta: Permission denied Cannot initialize: /opt/splunkforwarder/etc/apps/learned/metadata/local.meta: Permission denied Cannot initialize: /opt/splunkforwarder/etc/apps/learned/metadata/local.meta: Permission denied Since I did do the chown, this _should_ not happen, so quite sure that I've done something not totally correct when installing as root and then switching to Splunk as described here https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot-start_as_a_non-root_user - well, it is simply just the chown-command, but since splunk@myserver:~$ ls -la /opt/splunkforwarder/etc/apps/learned/metadata/local.meta -rw------- 1 root root 531 Mar 8 19:15 /opt/splunkforwarder/etc/apps/learned/metadata/local.meta Something is not correct on the server.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>