Splunk® Enterprise

Securing Splunk Enterprise with Common Criteria

This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Debug SELinux denials

In Splunk Enterprise for Common Criteria, denials are almost always the result of introducing a new policy:

1. Check the audit log to ensure there are no relevant denials: 

type=AVC

2. If there are any denials, convert them to allow rules for the Type Enforcement definition file (*.te).

For example, grep denies "/vr/log/audit/audit.log, you can convert to allow as follows: 

grep "denied" /var/log/audit/audit.log | audit2allow
Last modified on 08 April, 2016
Uninstall Splunk   Find errors

This documentation applies to the following versions of Splunk® Enterprise: 7.3.3, 7.3.4, 8.1.1, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters