ansible-role-for-splunk

ansible-role-for-splunk copied to clipboard

The logrotate config based on the splunk_facl.j2 template created by the configure_facl.yml task seems to be invalid:

logrotate[685980]: error: splunk_facl:1 lines must begin with a keyword or a filename (possibly in double quotes)
logrotate[685980]: error: splunk_facl:5 unexpected }
logrotate[685980]: error: found error in file splunk_facl, skipping

I believe, the file /roles/splunk/templates/splunk_facl.j2 should be changed from :

{
    postrotate
        /usr/bin/setfacl -Rm u:{{ splunk_nix_user }}:rx /var/log
    endscript
}

to

/var/log {
    postrotate
        /usr/bin/setfacl -Rm u:{{ splunk_nix_user }}:rx /var/log
    endscript
}

Or something like that (but i don't have means to validate my assumption

The problem has to do with \r characters. Just replace them at least that fixed the issue for me. tr -d '\r' < /etc/logrotate.d/splunk_facl> /etc/logrotate.d/splunk_facl

@JasperJuergensen Had the same issue and applied what you suggest to solve it ! Thanks again