RE: [syslog-ng] I/O error occurred while reading; fd='4', error='Operation not permitted (1)'
With the lack of the "-C" allowing the 4th file descriptor to be read indicates that the path to this file (or link) is not accessible from the jail. There are a few tools you could use to figure out which file is generating this log message. A good approach could involve starting the daemon through strace, and looking for the system "read" which results in a return of EACCESS. The first argument should be "4" representing the process' 4th file descriptor. A typical invocation would look like "strace -f -e trace=open,read <Syslog-NG CMD>", replacing <Syslog-NG CMD> with the appropriate command + arguments. If you are using Solaris you would use the truss utility. It's invocation would be similar: "truss -f -t open,read <Syslog-NG CMD>". You may also be able to find the problem simply verifying all the files in your "source" directives in your Syslog-NG configuration file. I hope this helps, Justin. -----Original Message----- From: Matt Miller [mailto:syslog-ng@mattmillersf.fastmail.fm] Sent: Tuesday, January 02, 2007 1:02 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] I/O error occurred while reading; fd='4', error='Operation not permitted (1)' I seem to have 2.0.0 running in a jail via the "-C" option, but when I start the service I see the following in /var/local/chroot/syslogng/var/log/syslog: Jan 2 16:48:19 xpc1 syslog-ng[19522]: syslog-ng starting up; version='2.0.0' Jan 2 16:48:19 xpc1 syslog-ng[19522]: I/O error occurred while reading; fd='4', error='Operation not permitted (1)' The daemon does seem to continue to run fine, since I am seeing facilities logging their activity to /var/local/chroot/syslogng/var/log/syslog. However, that second line above seems to indicate a problem. When I run syslog-ng without the "-C" option I don't get this second line. Am I missing something in my jail? Is the jailing process documented? _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
running in a jail via the "-C" option, but ... syslog-ng[19522]: I/O error occurred while reading; fd='4', error='Operation not permitted (1)'
starting the daemon through strace, and looking for the system "read" which results in a return of EACCESS. The first argument should be "4" representing the process' 4th file descriptor.
Thanks, I've been trying this, but the problem is not fixed yet. I've attached my 'strace' output. For fun I also traced "chroot" calls, since I'm thinking that it's after the chroot that things go bad. Looking at that attached output, my best guess at what's opened on descriptor 4 is /proc/kmsg. However, I did this: mount -t proc proc /var/local/chroot/syslogng/proc so I think I've got /prog/kmsg covered. What can I try next?
running in a jail via the "-C" option, but ... syslog-ng[19522]: I/O error occurred while reading; fd='4', error='Operation not permitted (1)'
Looking at that attached output, my best guess at what's opened on descriptor 4 is /proc/kmsg.
Could the problem be that /proc/kmsg is opened before the chroot, but then read after the chroot?
participants (2)
-
Justin Randall
-
Matt Miller