<div dir="ltr">Those options are also available as local, per-file sources. <div><br></div><div>But you are right, this might be a misfeature (or we could also call it a bug) that should be worth changing. But we need to do that careful as this has been the syslog-ng behaviour for over a decade :)</div><div><br></div><div>btw, we just had a similar github issue (<a href="https://github.com/balabit/syslog-ng/issues/1771">https://github.com/balabit/syslog-ng/issues/1771</a>) just yesterday.</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Tue, Nov 21, 2017 at 12:13 PM, Jim Segrave <span dir="ltr"><<a href="mailto:jes@j-e-s.net" target="_blank">jes@j-e-s.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">We are running syslog-ng on a Centos-7 server:<br>
<br>
root@usenetmonitor-fe01.am4:[~<wbr>]# /usr/sbin/syslog-ng -V<br>
syslog-ng 3 (3.12.1)<br>
Installer-Version: 3.12.1<br>
Revision:<br>
Compile-Date: Nov 3 2017 15:15:50<br>
Module-Directory: //usr/lib64/syslog-ng<br>
Module-Path: //usr/lib64/syslog-ng<br>
Available-Modules: afuser,cef,linux-kmsg-format,s<wbr>djournal,confgen,map-value-pai<wbr>rs,json-plugin,affile,kvformat<wbr>,tfgetent,date,afstomp,<wbr>csvparser,add-contextual-data,<wbr>cryptofuncs,system-source,<wbr>syslogformat,afsocket,afprog,<wbr>pseudofile,afamqp,snmptrapd-<wbr>parser,dbparser,xml,stardate,<wbr>tags-parser,graphite,<wbr>basicfuncs,disk-buffer<br>
Enable-Debug: off<br>
Enable-GProf: off<br>
Enable-Memtrace: off<br>
Enable-IPv6: on<br>
Enable-Spoof-Source: on<br>
Enable-TCP-Wrapper: on<br>
Enable-Linux-Caps: on<br>
Enable-Systemd: on<br>
<br>
When we tried to use syslog-ng to treat a file as a source, it changes the owner and group to root and the permissions to 0664, which is undesireable, as the file must remain writeable by the apache server.<br>
<br>
This is the source definition in syslog.conf when we were testing:<br>
<br>
source s_dev {<br>
file("/var/log/usenetmonitor/d<wbr>ev/cron-logs/Usenetmonitor-War<wbr>nings.log" flags(no-parse) program-override("custom-test"<wbr>));<br>
};<br>
<br>
with syslog-ng stopped, here's the status of the file:<br>
root@usenetmonitor-fe01:[~]# ls -lt /var/log/usenetmonitor/soc/cro<wbr>n-logs/Usenetmonitor-Warnings.<wbr>log<br>
-rw-r----- 1 apache apache 0 Nov 21 11:00 /var/log/usenetmonitor/soc/cro<wbr>n-logs/Usenetmonitor-Warnings.<wbr>log<br>
<br>
As soon as syslog-ng is started it becomes<br>
<br>
root@usenetmonitor-fe01:[~]# ls -lt /var/log/usenetmonitor/soc/cro<wbr>n-logs/Usenetmonitor-Warnings.<wbr>log<br>
-rw-r--r-- 1 root root 0 Nov 21 11:00 /var/log/usenetmonitor/soc/cro<wbr>n-logs/Usenetmonitor-Warnings.<wbr>log<br>
<br>
Checking with strace, I find<br>
<br>
16258 open("/var/log/usenetmonitor/d<wbr>ev/cron-logs/Usenetmonitor-War<wbr>nings.log", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 24<br>
<br>
Followed shortly therafter by:<br>
<br>
16258 fchown(24, 0, -1) = 0<br>
16258 fchown(24, -1, 0) = 0<br>
16258 fchmod(24, 0664) = 0<br>
<br>
(and no, fd 24 hasn't been closed and re-opened)<br>
<br>
It's unclear to me why syslog-ng would have any reason to change ownership or permissions of file sources. As there are no options for file sources to set what it would change it to, it seems highly undesireable that this happens.<br>
<br>
The only workaround is to set global options to disable changing ownership or permissions:<br>
<br>
perm(-1);<br>
owner(-1);<br>
group(-1);<br>
<br>
and then specify those options for every destination file which is a maintenance burden<br>
<br>
Is there some other way to stop syslog-ng from latering files used as sources?<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
Jim Segrave<br>
<a href="mailto:jes@j-e-s.net" target="_blank">jes@j-e-s.net</a><br>
<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
</font></span></blockquote></div><br></div>