Unable to change the group ownership of a file in journal files (4306606)

Unable to change the group ownership of a file in journal files

The group ownership of the file/directory was configured to use an AD group.  The correct ownership was correctly assigned to the file/directory however the journal files’ (*.jor) ownership remain the same.

The following errors were seen in the logs:
syslog-ng[54490]: Log store warning; filename='/data/log/abc/2021/11/08/192.11.10.2-20211108.log', message='Warning: Setting permissions of log store file failed; error=\'/data/log/xyz/2021/11/08/192.11.10.2-20211108.log\''

syslog-ng[54490]: Log store warning; filename='/data/log/abc/2021/11/08/192.11.10.2-20211108.log', message='Warning: Setting permissions of journal file failed; filename=\'/data/log/xyz/2021/11/08/192.11.10.2-20211108.log.jor\'  message=\'Operation not permitted\''

syslog-ng[54490]: Log store warning; filename='/data/log/abc/2021/11/08/host.test.com-20211108.log', message='Warning: Setting permissions of journal file failed; filename=\'/data/log/xyz/2021/11/08/host.test.com-20211108.log.jor\'  message=\'Operation not permitted\''

syslog-ng[54490]: Log store warning; filename='/data/log/xyz/2021/11/08/192.11.10.2-20211108.log', message='Warnings: setting permissions of logstore index file failed; error=\'Operation not permitted\''

WORKAROUND
1.    Modify the systemd service file of syslog-ng at:
/usr/lib/systemd/system/syslog-ng.service

2.    Change the line
ExecStart=/opt/syslog-ng/sbin/syslog-ng -F --enable-core $SYSLOGNG_OPTIONS

to

ExecStart=/opt/syslog-ng/sbin/syslog-ng -F --no-caps --enable-core $SYSLOGNG_OPTIONS

and perform service restart

# systemctl daemon-reload
# systemctl restart syslog-ng

STATUS
Change Request SYSLOGDEV-6165 has been raised with our Product team for consideration of inclusion in the future release of syslog-ng Premium Edition.

SYSLOGDEV-6165