# Access is denied while running metrics-per-process.rb check as agent is running with sensu user
**URL:** https://discourse.sensu.io/t/access-is-denied-while-running-metrics-per-process-rb-check-as-agent-is-running-with-sensu-user/1350
**Category:** Sensu Go
**Created:** [September 11, 2019, 2:37pm UTC](https://discourse.sensu.io/t/access-is-denied-while-running-metrics-per-process-rb-check-as-agent-is-running-with-sensu-user/1350 "2019-09-11T14:37:20Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@masifpak](https://discourse.sensu.io/u/masifpak)
#### Post date: [September 11, 2019, 2:37pm UTC](https://discourse.sensu.io/t/access-is-denied-while-running-metrics-per-process-rb-check-as-agent-is-running-with-sensu-user/1350/1 "2019-09-11T14:37:20Z")
My sensu agent is running with sensu user, I am running metrics-per-process.rb check to check tomcat. I have installed psutil which is required for metrics-per-process.rb. Now problem is that when check run by sensu agent it faces Access denied as shown below. I gave ownership to “/usr/lib64/python2.7/site-packages/psutil” to sensu user but no to avail. Please help me regarding the issue.
> Traceback (most recent call last):
> File “/opt/sensu-plugins-ruby/embedded/lib/ruby/gems/2.4.0/gems/sensu-plugins-process-checks-3.2.0/bin/metrics-per-process.py”, line 330, in
> main()
> File “/opt/sensu-plugins-ruby/embedded/lib/ruby/gems/2.4.0/gems/sensu-plugins-process-checks-3.2.0/bin/metrics-per-process.py”, line 323, in main
> graphite\_printer(multi\_pid\_process\_stats(pids, options.metrics\_regexes), options.graphite\_scheme)
> File “/opt/sensu-plugins-ruby/embedded/lib/ruby/gems/2.4.0/gems/sensu-plugins-process-checks-3.2.0/bin/metrics-per-process.py”, line 244, in multi\_pid\_process\_stats
> stats = Counter(stats) + Counter(stats\_per\_pid(pid, metrics\_regexes))
> File “/opt/sensu-plugins-ruby/embedded/lib/ruby/gems/2.4.0/gems/sensu-plugins-process-checks-3.2.0/bin/metrics-per-process.py”, line 236, in stats\_per\_pid
> stats.update(connection\_stats(process\_handler, metrics\_regexp))
> File “/opt/sensu-plugins-ruby/embedded/lib/ruby/gems/2.4.0/gems/sensu-plugins-process-checks-3.2.0/bin/metrics-per-process.py”, line 199, in connection\_stats
> tcp\_conns = process\_handler.connections(kind=‘tcp’)
> File “/usr/lib64/python2.7/site-packages/psutil/ **init**.py”, line 1278, in connections
> return self.\_proc.connections(kind)
> File “/usr/lib64/python2.7/site-packages/psutil/\_pslinux.py”, line 1516, in wrapper
> raise AccessDenied(self.pid, self.\_name)
> psutil.AccessDenied: psutil.AccessDenied (pid=1910)
---
### Author:  [@jspaleta](https://discourse.sensu.io/u/jspaleta)
#### Post date: [September 12, 2019, 7:35pm UTC](https://discourse.sensu.io/t/access-is-denied-while-running-metrics-per-process-rb-check-as-agent-is-running-with-sensu-user/1350/2 "2019-09-12T19:35:21Z")
hey!
So real quick response while I have a minute.
What is most likely going on is your system is treating the information you want to access as privileged.
You’ll need to make a decision on how you want to give the sensu-agent service the necessary privileged access. The sensu-agent packages come pre-configured to run as the unprivileged ‘sensu’ user on linux systems as a good default security practice, But the trade-off for that is, operators like yourself have to do a little more work to grant the sensu user enhanced privileged if your monitoring needs require access to privileged system information
I personally would suggest looking into configuring sudo for the specific command so that the sensu user can run the command with the least privileged access as possible. If you need help with that, I can probably come up with an example sudo configuration and check command if you are unfamiliar with tuning sudo.
-jef
---
### Author:  [@masifpak](https://discourse.sensu.io/u/masifpak)
#### Post date: [September 13, 2019, 7:59am UTC](https://discourse.sensu.io/t/access-is-denied-while-running-metrics-per-process-rb-check-as-agent-is-running-with-sensu-user/1350/3 "2019-09-13T07:59:14Z")
Thanks for you reply. If I add sensu in sudo group or wheel in Centos OR run sensu-agent with root privileges. Both are not the same things? If we can tune sudo group or wheel group please guide me according or share some helping material.
---
### Author:  [@jspaleta](https://discourse.sensu.io/u/jspaleta)
#### Post date: [September 17, 2019, 7:12pm UTC](https://discourse.sensu.io/t/access-is-denied-while-running-metrics-per-process-rb-check-as-agent-is-running-with-sensu-user/1350/4 "2019-09-17T19:12:32Z")
I would definitely recommend that you configure sudo as narrowly as possible to give the sensu user access to only the commands needs instead of running the sensu agent with enhanced privileges.
Or make use of the linux kernel capabilities if available to provide fine grained controls…to ensure the sensu-agent process and child processes only have read access to privileged information. I think it’s possible to use kernel capabilities defined in the systemd startup script for agent. I’ll need to test this for myself though to make sure it works as I expect.
I’ll try to write up an article that covers the options this week here in the forums and provide more details on multiple approaches.
-jef
-jef