Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've added user logstash into group adm using the command $ usermod -a -G adm logstash.

One of the files that the logstash agent is trying to read is /var/log/nginx/foo-access.log, which has the following permissions:

-rw-r----- 1 www-data adm 0 Jul 25 07:52 /var/log/nginx/foo-access.log

When I sudo su logstash I can read the file, BUT, when I $ sudo service logstash_agent restart (which the init script runs as the logstash user) it fills up the logstash logs with:

{:timestamp=>"2013-07-31T17:05:17.287000+0000", :message=>"failed to open /var/log/nginx/foo-access.log: Permission denied - /var/log/nginx/foo-access.log", :level=>:warn}

I can confirm the logstash user is in the adm group:

$ groups logstash
logstash : logstash adm

This file definitely has the right file access:

$ getfacl /var/log/nginx/foo-access.log
getfacl: Removing leading '/' from absolute path names
# file: var/log/nginx/foo-access.log
# owner: www-data
# group: adm

I've tried turning it off and on again.

share|improve this question
Your file doesn't seem to have the correct group write permissions. Chmod to fix – Nithin Meppurathu Jul 31 '13 at 17:32
I don't want to write to the file, like I said I want to read it. – Phil Sturgeon Jul 31 '13 at 17:37
I assume you also checked the parent directory permissions (/var/log/nginx) – dawud Jul 31 '13 at 17:48
getfacl /var/log/nginx/kapture-api3-access.log – Nithin Meppurathu Jul 31 '13 at 17:53
I added the output of that command to the question. I'd ran it before with the results I expect, so didn't bother initially. – Phil Sturgeon Jul 31 '13 at 17:56
up vote 5 down vote accepted

It turned out to be related to this bug in upstart:

Because adm was a secondary group it was not being applied to the process, which is broken as f**k and is apparently fixed in a later version.

My solution was to add setguid adm to the init file.

share|improve this answer

Here is a working workaround:

sudo vi /etc/init.d/logstash






sudo /etc/init.d/logstash start
share|improve this answer
Also works by adding "LS_GROUP=adm" to /etc/defaults/logstash - the nice part about that is that it's easier to manage using puppet . – thinice Apr 13 '15 at 19:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.