We just set up splunk in our environment and have made all our /var/log/messages owned by root:splunk mode 640 so that splunk can read and index these files. I was thinking I could add xymon user to splunk group and that would allow xymon to read /var/log/messages as well, but it doesn't seem to be working. I can read /var/log/messages as the xymon user but the msgs web page is still showing Cannot open logfile /var/log/messages : Permission deniedAny ideas on what else I can do to allow xymon to get these logs?
Have you restarted the xymon client? Changes to linux group memberships on apply to new logins...
Kind regards,
SebA
From: Elizabeth Jones [mailto:oogiejonz at yahoo.com] Sent: 14 September 2015 16:36 To: xymon at xymon.com Subject: reading /var/log/messages
We just set up splunk in our environment and have made all our /var/log/messages owned by root:splunk mode 640 so that splunk can read and index these files. I was thinking I could add xymon user to splunk group and that would allow xymon to read /var/log/messages as well, but it doesn't seem to be working. I can read /var/log/messages as the xymon user but the msgs web page is still showing
Cannot open logfile /var/log/messages : Permission denied Any ideas on what else I can do to allow xymon to get these logs?
You would need to restart the xymon client after adding it to the group. That sort of thing isn’t dynamic.
You may need to stop xymon, logout, log back in, and then start it. Depending on how you login to the xymon user.
Maybe run group before starting to make sure xymon is in the splunk group.
From: Elizabeth Jones [mailto:oogiejonz at yahoo.com] Sent: Monday, September 14, 2015 10:36 AM To: xymon at xymon.com Subject: reading /var/log/messages
We just set up splunk in our environment and have made all our /var/log/messages owned by root:splunk mode 640 so that splunk can read and index these files. I was thinking I could add xymon user to splunk group and that would allow xymon to read /var/log/messages as well, but it doesn't seem to be working. I can read /var/log/messages as the xymon user but the msgs web page is still showing
Cannot open logfile /var/log/messages : Permission denied Any ideas on what else I can do to allow xymon to get these logs? This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
Remember that you must restart Xymon to pick up any changes in the user/group settings (just as you need to logout/login if you add yourself to a group).
Regards, Henrik
Den 14-09-2015 kl. 17:35 skrev Elizabeth Jones:
We just set up splunk in our environment and have made all our /var/log/messages owned by root:splunk mode 640 so that splunk can read and index these files. I was thinking I could add xymon user to splunk group and that would allow xymon to read /var/log/messages as well, but it doesn't seem to be working. I can read /var/log/messages as the xymon user but the msgs web page is still showing Cannot open logfile /var/log/messages : Permission denied Any ideas on what else I can do to allow xymon to get these logs?
participants (4)
-
henrik＠hswn.dk
-
oogiejonz＠yahoo.com
-
Paul.Root＠CenturyLink.com
-
spah＠syntec.co.uk