On November 9, 2017 10:21:04 PM CST, dchappelle via rsyslog <rsyslog@lists.adiscon.com> wrote: >Apologies for not including the config. Here is >/etc/rsyslog.d/10-example.conf: > > dchappelle@L164:/etc/rsyslog.d$ cat 10-example.conf > local0.* /var/log/test.log > & stop > >The actual issue here looks to be a permissions issue. The syslog user >does >not have permission to create files in /var/log. Here are the >permissions on >that directory: > > dchappelle@L164:/etc/rsyslog.d$ ls -l /var | grep log > drwxr-xr-x 14 root syslog 4096 Nov 9 19:27 log > >As you can see, the log directory belongs to the syslog group however >the >permissions for group are set to read/execute. As a result, rsyslogd is >unable to create new files in the directory but can update/write >existing >files that have proper group permissions:
I don't have a fresh/stock 16.04 box in front of me, so I will have to check tomorrow and respond back again then. If you haven't seen it yet, please take a look at the notes on this issue (linked from the GitHub issue link I provided earlier): https://github.com/rsyslog/rsyslog/issues/1655 0755 is enforced by stock systemd (via tmpfiles.d file), so as you noted the syslog group is unable to write to the root of /var/log. Attempts to change permissions manually are lost on boot. The maintainers of the Ubuntu-provided rsyslog package include a tmpfiles.d override file to grant 0775 permissions to /var/log at boot. Did you perform a fresh installation of Ubuntu 16.04 or did you perform an in-place upgrade from an earlier version? Do you have a /usr/lib/tmpfiles.d/00rsyslog.conf file on your system? See this post specifically for my summary of the situation as I found it some months ago (though I think the whole discussion is still relevant): https://github.com/rsyslog/rsyslog/issues/1655#issuecomment-314272947 Without confirming with a 16.04 box, it sounds like you are missing the /usr/lib/tmpfiles.d/00rsyslog.conf file that Ubuntu provided to set 0775 on /var/log at boot. You can create your own file in /etc/tmpfiles.d/ if your box is missing the file. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
