Install the Remote Upgrader for Linux Universal Forwarders

You can install the Remote Upgrader for Linux Universal Forwarders in one of two ways:

• Install the Remote Upgrader for Linux Universal Forwarders and run it as an existing user and group.
• Install the Remote Upgrader for Linux Universal Forwarders and create new users and groups with permissions.

Install the Remote Upgrader for Linux Universal Forwarders and run it as a specific user and group

The Remote Upgrader for Linux Universal Forwarders installer must run as root or sudo. This is because the remote upgrader requires system administrator permissions to set up the daemon configurations. Once Remote Upgrader installation is complete, the daemon can run as another user and group that you specify during the installation, provided that said user has appropriate permissions. To specify the user or group that will run the Remote Upgrader for Linux Universal Forwarders installation script:

• To use an existing user and group, run --user <user> --group <group>.
• The following is an example of how to install the Remote Upgrader for Linux Universal Forwarders and run it as a predefined user and group:

sudo ./bin/install.sh --accept-license --user <user> --group <group>

Any user or group your configure must also be a sudo user. If any of the following commands cannot run as passwordless sudo, the installation will fail.

sudo command	Why
systemctl	To operate the upgrader daemon as a systemd service.
pkill	To kill splunkd or the upgrade process when the process is hanging.
chmod	To set the file or directory permissions to make them available to Splunk apps to deliver the universal forwarder package
chown	To set SPLUNK_HOME ownership after upgrade.
cp	To copy files to or from SPLUNK_HOME.
rm	To remove SPLUNK_HOME when rolling back an upgrade, for example, in the case of upgrade failure.
find	To find SPLUNK_HOME globally before upgrading.
mkdir	To create directories in the SPLUNK_HOME directory.
cat	To read files to SPLUNK_HOME.
stat	To get previous Splunk users from the SPLUNK_HOME/bin/splunk file owner.
ps	To get the Splunk process owner.
test	To test file directory presence in SPLUNK_HOME.
sed	To update the Remote Upgrader for Linux Universal Forwarders configurations.
tar	To unpack Splunk packages to SPLUNK_HOME that might be owned by root.

Install the Remote Upgrader for Linux Universal Forwarders and create new users and groups with permissions

If you do not have a user and group with permissions, you can use the Remote Upgrader for Linux Universal Forwarders installer to create a dedicated user or group you can use by running --create-user. For example:

sudo ./bin/install.sh --accept-license --create-user

When the installer creates the user, the list of sudo commands described here are written to the /etc/sudoers.d/<username> file to enable passwordless sudo.

.