I have the following in my syslog-ng.conf for options:

options {

stats_freq(60);

flush_lines(500);

#flush_timeout(10000);

time_reopen(10);

time_reap(5);

log_fifo_size(536870912);

chain_hostnames(off);

log-msg-size(65536);

use_dns(no);

keep_hostname(yes);

use_fqdn(yes);

dns_cache(off);

dns-cache-size(2000);

dns-cache-expire(87600);

create_dirs(yes);

perm(0640);

owner(root);

group(splunk);

dir-perm(2750);

dir-owner(root);

dir-group(splunk);

threaded(yes);

};

However, instead of 2750 for the directory permissions, I'm seeing

d-wSrwxrwT. 10 root splunk 4096 Mar 28 14:07 ise

[root@molecule8-mfaine data]# stat -c '%a' ise

5276

I would expect:

drwxr-s---. 2 root splunk 4096 Mar 28 14:11 ise

Where are these permissions coming from?

Thanks,

Mark