Cribl Edge RPM Service Fails to Start with EPERM Removing /tmp/cribl_edge

Symptom

Cribl Edge installed via RPM fails to stay running when systemd starts the cribl-edge service.

The diagnostic reports: EPERM: operation not permitted, rmdir '/tmp/cribl_edge'.

Environment

• Cribl Edge on Linux, installed via RPM.
• systemd-managed cribl-edge service running as cribl-edge.

Resolution

On the Linux host, have your Linux administrator complete these steps:

1. Stop the Cribl Edge service.

   sudo systemctl stop cribl-edge

2. Change ownership of /tmp/cribl_edge to cribl-edge:cribl-edge.

   sudo chown -R cribl-edge:cribl-edge /tmp/cribl_edge

3. Start the Cribl Edge service through systemd.

   sudo systemctl start cribl-edge

4. Verify the Cribl Edge service status.

   sudo systemctl status cribl-edge --no-pager -l

Cause

This can be caused by starting Cribl directly as root, which leaves /tmp/cribl_edge owned by root. The cribl-edge service account cannot remove this directory.

Additional Information

To create a diagnostic bundle from an RPM-installed Cribl Edge node, run the command as cribl-edge and set the volume directory. Use -g to exclude Git data when Git is not installed:

sudo -u cribl-edge env CRIBL_VOLUME_DIR=/var/lib/cribl-edge /opt/cribl-edge/bin/cribl diag create -g