Splunk® IT Service Intelligence

Entity Integrations Manual

Collect data in ITSI with SELinux

You may encounter these issues when you try to deploy collectd on a host that's running SELinux:

  • collectd's LogFile plug-in doesn't have persmissions to write to its log.
  • collectd can't establish a network connection and you see the CURL failed with status 7 error.

If you're running SELinux and want to deploy collectd, follow one of the following options so you don't encounter any failures.

Option 1:

Run the collectd process type in permissive mode:

semanage permissive -a collectd_t

SELinux won't deny access to collectd anymore, but you may still see the SELinux denial message.

Option 2:

  1. Fix the blocked network connection for collectd:
    setsebool -P collectd_tcp_network_connect 1
  2. Fix the permission denied for the LogFile plug-in. collectd's log is also available from syslog, and shouldn't require any changes to access from there. Use /var/log/collectd.log in collectd.conf for the LogFile plug-in.
  3. Create the mypolicy.te file with this content:
    module mypolicy 1.0;
    require {
    type var_log_t;
    type collectd_t;
    class dir { add_name read write };
    class file { create open write };
    #============= collectd_t ==============
    allow collectd_t var_log_t:dir { add_name write };
    allow collectd_t var_log_t:file open;
    allow collectd_t var_log_t:file create;
  4. Compile mypolicy.te:
    $ checkmodule -M -m -o mypolicy.mod mypolicy.te
    $ semodule_package -o mypolicy.pp -m mypolicy.mod
  5. Apply the policy package mypolicy.pp to SELinux:
    $ semodule -i mypolicy.pp
Last modified on 28 April, 2023
collectd package sources, install commands, and locations for ITSI   Send collectd data to a local universal forwarder in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1, 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters