I've added user logstash into group adm using the command $ usermod -a -G adm logstash.

One of the files that the logstash agent is trying to read is /var/log/nginx/foo-access.log, which has the following permissions:

-rw-r----- 1 www-data adm 0 Jul 25 07:52 /var/log/nginx/foo-access.log

When I sudo su logstash I can read the file, BUT, when I $ sudo service logstash_agent restart (which the init script runs as the logstash user) it fills up the logstash logs with:

{:timestamp=>"2013-07-31T17:05:17.287000+0000", :message=>"failed to open /var/log/nginx/foo-access.log: Permission denied - /var/log/nginx/foo-access.log", :level=>:warn}

I can confirm the logstash user is in the adm group:

$ groups logstash
logstash : logstash adm

This file definitely has the right file access:

$ getfacl /var/log/nginx/foo-access.log
getfacl: Removing leading '/' from absolute path names
# file: var/log/nginx/foo-access.log
# owner: www-data
# group: adm

I've tried turning it off and on again.

  • Your file doesn't seem to have the correct group write permissions. Chmod to fix Jul 31, 2013 at 17:32
  • I don't want to write to the file, like I said I want to read it. Jul 31, 2013 at 17:37
  • I assume you also checked the parent directory permissions (/var/log/nginx)
    – dawud
    Jul 31, 2013 at 17:48
  • getfacl /var/log/nginx/kapture-api3-access.log Jul 31, 2013 at 17:53
  • I added the output of that command to the question. I'd ran it before with the results I expect, so didn't bother initially. Jul 31, 2013 at 17:56

2 Answers 2


It turned out to be related to this bug in upstart:


Because adm was a secondary group it was not being applied to the process, which is broken as f**k and is apparently fixed in a later version.

My solution was to add setguid adm to the init file.


Here is a working workaround:

sudo vi /etc/init.d/logstash






sudo /etc/init.d/logstash start
  • 1
    Also works by adding "LS_GROUP=adm" to /etc/defaults/logstash - the nice part about that is that it's easier to manage using puppet .
    – thinice
    Apr 13, 2015 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.