splunk / ansible-role-for-splunk

Splunk@Splunk's Ansible role for installing Splunk, upgrading Splunk, and installing apps/addons on Splunk deployments (VM/bare metal)

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Logrotate config invalid

JasperJuergensen opened this issue · comments

The logrotate config based on the splunk_facl.j2 template created by the configure_facl.yml task seems to be invalid:

logrotate[685980]: error: splunk_facl:1 lines must begin with a keyword or a filename (possibly in double quotes)
logrotate[685980]: error: splunk_facl:5 unexpected }
logrotate[685980]: error: found error in file splunk_facl, skipping

I believe, the file /roles/splunk/templates/splunk_facl.j2 should be changed from :

{
    postrotate
        /usr/bin/setfacl -Rm u:{{ splunk_nix_user }}:rx /var/log
    endscript
}

to

/var/log {
    postrotate
        /usr/bin/setfacl -Rm u:{{ splunk_nix_user }}:rx /var/log
    endscript
}

Or something like that (but i don't have means to validate my assumption

The problem has to do with \r characters. Just replace them at least that fixed the issue for me.
tr -d '\r' < /etc/logrotate.d/splunk_facl> /etc/logrotate.d/splunk_facl

@JasperJuergensen Had the same issue and applied what you suggest to solve it ! Thanks again