Splunk® IT Service Intelligence

Entity Integrations Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Collect data in ITSI with SELinux

You may encounter these issues when you try to deploy collectd on a host that's running SELinux:

  • collectd's LogFile plug-in doesn't have persmissions to write to its log.
  • collectd can't establish a network connection and you see the CURL failed with status 7 error.

If you're running SELinux and want to deploy collectd, follow one of the following options so you don't encounter any failures.

Option 1:

Run the collectd process type in permissive mode:

semanage permissive -a collectd_t

SELinux won't deny access to collectd anymore, but you may still see the SELinux denial message.

Option 2:

  1. Fix the blocked network connection for collectd:
    setsebool -P collectd_tcp_network_connect 1
    
  2. Fix the permission denied for the LogFile plug-in. collectd's log is also available from syslog, and shouldn't require any changes to access from there. Use /var/log/collectd.log in collectd.conf for the LogFile plug-in.
  3. Create the mypolicy.te file with this content:
    module mypolicy 1.0;
    
    require {
    type var_log_t;
    type collectd_t;
    class dir { add_name read write };
    class file { create open write };
    }
    
    #============= collectd_t ==============
    
    allow collectd_t var_log_t:dir { add_name write };
    allow collectd_t var_log_t:file open;
    allow collectd_t var_log_t:file create;
    
  4. Compile mypolicy.te:
    $ checkmodule -M -m -o mypolicy.mod mypolicy.te
    $ semodule_package -o mypolicy.pp -m mypolicy.mod
    
  5. Apply the policy package mypolicy.pp to SELinux:
    $ semodule -i mypolicy.pp
    
Last modified on 11 November, 2020
PREVIOUS
collectd package sources, install commands, and locations for ITSI
  NEXT
Send collectd data to a local universal forwarder in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters