Hello list,
I am using rsyslog 8.4.0 (cannot upgrade) with the following action statement:
template (name="t_dynamicFileBla" type="string"
string="/var/log/bla/%msg:R,ERE,1,BLANK:\"blaId\":\"([a-zA-Z0-9-]+)\"--end%/%msg:R,ERE,1,BLANK:\"type\":\"([a-zA-Z]+)\"--end%/%msg:R,ERE,1,BLANK:\"type\":\"([a-zA-Z]+)\"--end%.log")
if ($msg contains 'bla')
then {
action(type="omfile" fileGroup="bla"
fileOwner="bla" dynaFile="t_dynamicFileBla" dirCreateMode="0755"
fileCreateMode="0644")
stop
}
I'm observing a strange behavior on newly created files (not folders). Some
files are owned by root instead of the user "bla". rsyslogd runs as root (no
priv dropping) via systemd on a Suse Linux Enterprise 12 system and it seems to
sporadically create these files not owned by "bla" but by "root".
I am wondering if this is an issue on chown after file creation?
Is the file created as root and then chown to $user:$group or created directly
as $user:$group?
Looking at the changelog, I can see commit
https://github.com/rsyslog/rsyslog/commit/aa0056dcba3c90ac12a7c424f800a8a2ad61e48d
mentioning a bugfix for chown() but I am not sure whether that's relevant in
my case.
Hope to hear from you soon.
--
Kind Regards,
G
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
