Hello Beef 8-):
In message
<CAHkPr1En_H-SJPYnRYKu1uVtwUetvvyJ=w5j4+nmol96qec...@mail.gmail.com> ,
Orangepeel Beef writes:
>When using action = write %f
>
>is there any way to set file permissions on the files that are created?
>
>Currently they seem to be being created 600 and I would really like to make
>them 640 and set the logstash group.
>
>I'm calling SEC from rsyslog via omprog.
>
>Are people just setting umask to get around this?
I set the umask in the parent process before starting sec.
Since you are running from rsyslog, I suggest calling umask 037 (IIRC)
via an action on startup (see --intevents for a way to trigger a rule
on startup). Use a perl eval:
action=eval %a (umask 037)
Something like that should work.
>If so I'll have to add the logstash group as the privdropgroup on rsyslog
Create the output directory (where %f gets created) with owner set to
the user running SEC. Set the group of the directory to logstash. Set
the mode on the directory to 2755. This should (on many filesystems)
cause newly created files in the directory to inherit the group from
the parent directory (logstash). Any new subdirectories again inherit
the group as well as the setgid bit.
Hope this helps.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
