rsyslog permission denied

Issues related to applications and software problems and general support
Post Reply
johnhk215
Posts: 8
Joined: 2020/02/03 06:53:09

rsyslog permission denied

Post by johnhk215 » 2020/03/23 13:28:13

syslog service can be started with error
rsyslog rsyslogd[2253]: imjournal: fopen() failed for path: '/var/lib/rsyslog/imjournal.state.tmp': Permission denied

Change log path to /opt/rsyslog

---------------------------------------------------------------
chcon --reference /var/log /opt/rsyslog

Rsyslog config
------------------------------------------------------------
$template RemoteLogs,"/opt/rsyslog/%HOSTNAME%/%HOSTNAME%-%$YEAR%-%$MONTH%-%$DAY%.log"
*.* ?RemoteLogs
& ~

#
# Set the default permissions for all log files.
#
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

# These may require root
$FileOwner syslog
$FileGroup syslog
$PrivDropToUser syslog
$PrivDropToGroup syslog

----------------------------------------------------------------

if #$PrivDropToUser syslog -> no permission denied but syslog user doesn't have /opt/rsyslog

Any advise?

Thanks.

User avatar
TrevorH
Forum Moderator
Posts: 28026
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: rsyslog permission denied

Post by TrevorH » 2020/03/23 14:47:44

Looks like your problem is caused by you trying to move it to /opt/rsyslog. Is there a reason why you'd try to do that?
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

johnhk215
Posts: 8
Joined: 2020/02/03 06:53:09

Re: rsyslog permission denied

Post by johnhk215 » 2020/03/24 01:59:21

Yes, It is central logging server and would like to put the data in to /opt/data instead of default path /var/log.
Can I ignore the permission denied message?

Thanks.

pjsr2
Posts: 448
Joined: 2014/03/27 20:11:07

Re: rsyslog permission denied

Post by pjsr2 » 2020/03/24 10:11:09

You cannot simply ignore the message.

There is a whole bunch of selinux context settings that apply to /var/log and the log files and subdirectories in it, written by various applications. If you move your log files from /var/log to /opt/log you need to get these selinux fcontext sorted out, which is a whole lot of work.

You should expect logging problems similar to the one you already observed from other applications, and they may not show up immediately as it may take time before applications feel the need to log something. Some applications don't care when they can't log. Other applications fail when they can't log. If applications cannot log, that may have security implications, as you may loose important warning signals.

User avatar
TrevorH
Forum Moderator
Posts: 28026
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: rsyslog permission denied

Post by TrevorH » 2020/03/24 10:15:22

If you moved it to give more space then I would suggest mounting that filesystem on /var/log to begin with (though that's more complicated than just that as you will need to copy the existing content over first and probably relabel the filesystem afterwards once it's mounted on /var/log).

As pjsr2 says, ther are numerous selinux rules set up to allow access and you would need to duplicate or set up equivalence rules for those

Code: Select all

# semanage fcontext -l | grep -c var_log
66
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

johnhk215
Posts: 8
Joined: 2020/02/03 06:53:09

Re: rsyslog permission denied

Post by johnhk215 » 2020/03/26 15:14:50

Thank you for yours information.
Can I change Rsyslog store log path to another path without change /var/log ?

User avatar
TrevorH
Forum Moderator
Posts: 28026
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: rsyslog permission denied

Post by TrevorH » 2020/03/26 15:21:05

I thought that's what we've been telling you is too complicated and that you shouldn't do? But maybe I misunderstood your question.
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

Post Reply

Return to “CentOS 8 - General Support”