Documentation: 3.3
|  Print Version Contents
This page last updated: 04/23/08 04:04pm

Run Splunk as non-root user

Splunk can run as any user on the local system. If you run Splunk as a non-root user, make sure Splunk has the appropriate permissions to:

  • Read the files and directories it is configured to watch. Some log files and directories may require root or superuser access to be indexed.
  • Write to Splunk's directory and execute any scripts configured to work with your alerts or scripted input.
  • Bind to the network ports it is listening on (ports below 1024 are reserved ports that only root can bind to).

Note: Splunk will not accept syslog data over port 514 (the default listening port for UDP). This does not mean that Splunk cannot listen on UDP 514; you can add UDP 514 as a data input.

To run Splunk as a non-root user:

  1. Create the user and group, splunk.
  2. As root and using one of the packages (not a tarball), run the installation.
  3. Change the ownership, chown, of the splunk directory and everything under it to the desired user.

For example, if you wanted to run Splunk as the splunk user:

sudo -H -u splunk /opt/splunk/bin/splunk start

Note: This example command assumes:

  • If Splunk is installed in an alternate location, update the path in the command accordingly.
  • Your system may not have sudo installed. If this is the case, you can use su.
  • If you are installing using a tarball and want Splunk to run as a particular user (such as splunk), you must create that user manually.

Solaris 10 privileges

When installing on Solaris 10 as the splunk user, you must set additional privileges to start splunkd and bind to reserved ports.

To start splunkd as the splunk user on Solaris 10, run:

# usermod -K defaultpriv=basic,net_privaddr,proc_exec,proc_fork splunk

To allow the splunk user to bind to reserved ports on Solaris 10, run (as root):

# usermod -K defaultpriv=basic,net_privaddr splunk

Previous: Configure Splunk before startup    |    Next: Disable update checker

Comments

  1. Hi
    We would like to install with a Non-Root and ID. Is there any way to do that with out using SUDO or SU to start the process?
    Ramki
    Posted by gpallirk on Jun 26 2008, 10:08am

  2. Tried running as splunk on RHEL 5 and appears that some of the directory permissions are incorrect.

    [splunk@quatt ~]$ splunk start
    Checking prerequisites...
    Checking http port [8000]: open
    Checking mgmt port [8089]: open
    Verifying configuration. This may take a while...
    Finished verifying configuration.
    Checking index directory...
    Verifying databases...
    Verified databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, metaevents, sampledata, splunklogger

    Checking for SELinux.
    Checking index files
    All index checks passed.
    All preliminary checks passed.
    Starting splunkd... [ OK ]
    Starting splunkweb.../opt/splunk/share/splunk/certs does not exist. Will create
    Couldn't create directory "/opt/splunk/share/splunk/certs": Permission denied
    [splunk@quatt ~]$ cd /opt/splunk/share/splunk/

    The permissions:
    [splunk@quatt share]$ ll /opt/splunk/share/
    total 4
    dr-xr-xr-x 6 splunk splunk 4096 Jun 10 09:04 splunk
    Posted by gumshoes on Jun 10 2008, 8:39am

Log in to comment.