This happens when you re-create or mess with /var/log/secure
file. This will break file permissions, especially if SELinux is enabled.
Do the following:
Make sure /var/log/secure
is owned by root:root
$ sudo chown root:root /var/log/secure
Make sure the permission is set to 600
$ sudo chmod 600 /var/log/secure
If SELinux is enabled, you can temporarily disable while troubleshooting your issue
$ sudo setenforce 0
If you decide to keep SELinux enabled, make sure the file has the following context:
$ ls -lZh /var/log/secure
system_u:object_r:var_log_t:s0
To manipulate SELinux on the fly (copy context from an existing known working):
$ sudo chcon --reference /var/log/dmesg /var/log/secure
To manipulate SELinux context permanently, use the semanage command instead.
ls -lhZ /var/log/secure
andsestatus
say. I would also recommend usingless
or something similarly read-only when viewing logs.nano
is kinda dangerous in my (admittedly dated) experience (nano -w
is much safer when looking at config files especially).-rw------- root root ?
and sestatus says disabled. Thanks!logrotate -f /etc/logrotate.conf
(check using the manual page that -f will do a force though). If you do something like a login, then you should see that new entries in the file. You might also look for other reasons it might fail (eg. dodf -h /var/log/
ordf -hi /var/log/
show using at 100%). Failing that, you might check that your syslog (rsyslogd / syslogd) is still running. What version of ContOS are you using?ls -lh /dev/log
show?