With the lack of the "-C" allowing the 4th file descriptor to be read indicates that the path to this file (or link) is not accessible from the jail. There are a few tools you could use to figure out which file is generating this log message. A good approach could involve starting the daemon through strace, and looking for the system "read" which results in a return of EACCESS. The first argument should be "4" representing the process' 4th file descriptor. A typical invocation would look like "strace -f -e trace=open,read <Syslog-NG CMD>", replacing <Syslog-NG CMD> with the appropriate command + arguments. If you are using Solaris you would use the truss utility. It's invocation would be similar: "truss -f -t open,read <Syslog-NG CMD>". You may also be able to find the problem simply verifying all the files in your "source" directives in your Syslog-NG configuration file. I hope this helps, Justin. -----Original Message----- From: Matt Miller [mailto:syslog-ng@mattmillersf.fastmail.fm] Sent: Tuesday, January 02, 2007 1:02 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] I/O error occurred while reading; fd='4', error='Operation not permitted (1)' I seem to have 2.0.0 running in a jail via the "-C" option, but when I start the service I see the following in /var/local/chroot/syslogng/var/log/syslog: Jan 2 16:48:19 xpc1 syslog-ng[19522]: syslog-ng starting up; version='2.0.0' Jan 2 16:48:19 xpc1 syslog-ng[19522]: I/O error occurred while reading; fd='4', error='Operation not permitted (1)' The daemon does seem to continue to run fine, since I am seeing facilities logging their activity to /var/local/chroot/syslogng/var/log/syslog. However, that second line above seems to indicate a problem. When I run syslog-ng without the "-C" option I don't get this second line. Am I missing something in my jail? Is the jailing process documented? _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html