Splunk Add-on for Cisco ESA: Data not ingested in Splunk.

Applicability

Description

The Cisco ESA sourcetypes cisco:esa:textmail and cisco:esa:cef not ingesting any data in Splunk that is being appended in the Splunk Forwarder instance having a Linux OS.

Investigation

Checked the Cisco ESA error logs with the following SPL:

index=_internal sourcetype=*cisco*

The following exceptions are found in the Cisco logs:

WARN TailReader [2009 tailreader0] - Access error while handling path: failed to open for checksum: '/newhome/esalogs/mail/mail.text.esa2.hc2281-59.iphmx.com.423A388266487C87F679-5B25639B7D84.@20240827T134723.s' (Permission denied)

The above error indicates that Splunk does not have permission to access the files.

Resolution

The Splunk users don't have permission to read the Cisco logs directory, after providing the read access to the Cisco logs directory /newhome/esalogs/mail/ to the Splunk user, the issue was resolved and the logs were getting ingested properly in Splunk.

Related Links

Provide read-only permission using chmod command in Linux