Hi, I am setting up centralized logging from FreeIPA version 4.10.1 running on CentOs. I have tried to set up the logging, initially just the access log, using this config (with domain and ips obfuscated)
module(load="imfile") input(type="imfile" File="/var/log/dirsrv/slapd-MY_DOMAIN/access" Tag="ipa-security-log" Facility="local0") # Forward local facilities if $syslogfacility >= 16 then @my_ip_adress:514 When restarting rsyslog with this config , I get error message (with servername and domains obfuscated): Aug 29 10:46:28 myserver.mydomain.net systemd[1]: Starting System Logging Service... Aug 29 10:46:28 myserver.mydomain.net rsyslogd[12607]: *imfile: on startup file '/var/log/dirsrv/slapd-MY-DOMAIN/access' does not exist but is configured in static file monitor - this may indicate a misconfiguration. If the file appears at a later time, it will automatically be processed. Reason: Permission denied [v8.2102.0-109.el9]* Aug 29 10:46:28 myserver.mydomain.net systemd[1]: Started System Logging Service. Aug 29 10:46:28 myserver.mydomain.net rsyslogd[12607]: [origin software="rsyslogd" swVersion="8.2102.0-109.el9" x-pid="12607" x-info=" https://www.rsyslog.com";] start Aug 29 10:46:28 myserver.mydomain.net rsyslogd[12607]: *imfile: error accessing file '/var/log/dirsrv/slapd-MY-DOMAIN/access': Permission denied [v8.2102.0-109.el9]* Aug 29 10:46:28 myserver.mydomain.net rsyslogd[12607]: *imjournal: journal files changed, reloading... [v8.2102.0-109.el9 try https://www.rsyslog.com/e/0 <https://www.rsyslog.com/e/0> ]* I have observed the following, following tips on various threads and info found on internet. - rsyslog is working as intended when exporting the standard linux logs - rsyslog is running as root. There is no drop privileges configured. I have checked this in the /etc/rsyslog.conf, and I also see that rsyslog is running as root when using ps -ef | grep rsyslogd - running as root should enable it to read any file - - I have tried to turn off SELinix, the problem remains the same. I have also checked logs , but there are no signs of SELinux being the cause of the problem. - FreeIPA is using its system user dirsrv when creating the files. - The ownership of the directories and files are as follows: drwxr-xr-x. 3 root root 28 Aug 23 15:23 *dirsrv* drwxrwx--x. 2 dirsrv dirsrv 4096 Aug 28 16:55 *slapd-MY-DOMAIN* -rw-------. 1 dirsrv dirsrv 6007159 Aug 29 10:56 *access* - I have tried to manually change the access rights of the access file with chmod o+r access and set chmod o+x on the slapd-directory. This removes the error after restart of rsyslog, and rsyslog exports the logs as expected. - However, due to the FreeIpa log rotation set-up, new files are created and rotated removing the read access for others, and the logging stops again. Has anyone seen anything similar, does anyone have any clues about what the cause of this could be? regards, Ole _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
