That worked. Thanks! From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> On Behalf Of Evan Rempel Sent: Monday, March 28, 2022 09:31 To: syslog-ng@lists.balabit.hu Subject: [EXTERNAL] Re: [syslog-ng] Permissions are not set correctly on created directories What appears to be happening is that your permission of 2750 is being interpreted as base 10 number which is octal 5276 Try adding a leading 0 to that number. Evan. On 2022-03-28 07:14, Faine, Mark R. (MSFC-IS40)[NICS] wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. I have the following in my syslog-ng.conf for options: options { stats_freq(60); flush_lines(500); #flush_timeout(10000); time_reopen(10); time_reap(5); log_fifo_size(536870912); chain_hostnames(off); log-msg-size(65536); use_dns(no); keep_hostname(yes); use_fqdn(yes); dns_cache(off); dns-cache-size(2000); dns-cache-expire(87600); create_dirs(yes); perm(0640); owner(root); group(splunk); dir-perm(2750); dir-owner(root); dir-group(splunk); threaded(yes); }; However, instead of 2750 for the directory permissions, I'm seeing d-wSrwxrwT. 10 root splunk 4096 Mar 28 14:07 ise [root@molecule8-mfaine data]# stat -c '%a' ise 5276 I would expect: drwxr-s---. 2 root splunk 4096 Mar 28 14:11 ise Where are these permissions coming from? Thanks, Mark