If a currently used log file is being renamed and a new empty file is being put in its place, syslog-ng will ATTEMPT to detect the change, however if any directory on the path missing read and execute permission for the user syslog-ng run as, even root, it fails.
In such cases syslog-ng will show the following error:
Follow mode file still does not exist; filename
Syslog-ng drops certain capabilities when it is starting, for security reasons. Therefore it need access to directories like a regular user - even if ran as root - to be able to execute the system calls to detect the change after the file rotation.
The user needs a read and execute permission on every directory on the path of the file source.
All the below command worked for setting the permission:
# chmod o+rx /home/user1
# setfacl -m u:root:rx /home/user1
# usermod -a -G user1 root
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Conditions d’utilisation Confidentialité Cookie Preference Center