Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've added user logstash into group adm using the command $ usermod -a -G adm logstash.

One of the files that the logstash agent is trying to read is /var/log/nginx/foo-access.log, which has the following permissions:

-rw-r----- 1 www-data adm 0 Jul 25 07:52 /var/log/nginx/foo-access.log

When I sudo su logstash I can read the file, BUT, when I $ sudo service logstash_agent restart (which the init script runs as the logstash user) it fills up the logstash logs with:

{:timestamp=>"2013-07-31T17:05:17.287000+0000", :message=>"failed to open /var/log/nginx/foo-access.log: Permission denied - /var/log/nginx/foo-access.log", :level=>:warn}

I can confirm the logstash user is in the adm group:

$ groups logstash
logstash : logstash adm

This file definitely has the right file access:

$ getfacl /var/log/nginx/foo-access.log
getfacl: Removing leading '/' from absolute path names
# file: var/log/nginx/foo-access.log
# owner: www-data
# group: adm
user::rw-
group::r--
other::---

I've tried turning it off and on again.

share|improve this question
    
Your file doesn't seem to have the correct group write permissions. Chmod to fix –  Nithin Meppurathu Jul 31 '13 at 17:32
    
I don't want to write to the file, like I said I want to read it. –  Phil Sturgeon Jul 31 '13 at 17:37
    
I assume you also checked the parent directory permissions (/var/log/nginx) –  dawud Jul 31 '13 at 17:48
    
getfacl /var/log/nginx/kapture-api3-access.log –  Nithin Meppurathu Jul 31 '13 at 17:53
    
I added the output of that command to the question. I'd ran it before with the results I expect, so didn't bother initially. –  Phil Sturgeon Jul 31 '13 at 17:56

2 Answers 2

up vote 4 down vote accepted

It turned out to be related to this bug in upstart:

https://bugs.launchpad.net/upstart/+bug/812870

Because adm was a secondary group it was not being applied to the process, which is broken as f**k and is apparently fixed in a later version.

My solution was to add setguid adm to the init file.

share|improve this answer

Here is a working workaround:

sudo vi /etc/init.d/logstash

modify

    LS_GROUP=logstash

by

    LS_GROUP=adm

then

sudo /etc/init.d/logstash start
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.