[syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'

[Justin Randall]

This cleared a few things up.

Should have noticed this earlier when looking at the return code for the "read" system call:

"read(4, 0x55ad20, 8192)                 = -1 EPERM (Operation not permitted)"

This is indicative of access control restrictions.  If you consider the file trying to be read ("/proc/kmsg") and it's permissions (only readable as root) it makes sense why you are getting permission errors when trying to as user "syslogng".

You are also experiencing other permission related errors on certain files:

/var/log/syslog
/var/log/messages
/dev/xconsole

File attribute changes are failing due to only being modifiable as root, but being modified as user "syslogng".

If you want to verify this claim, try running the daemon as root, and you should no longer see this problem.

You will likely have to tune file access/location suitable to your secutiry and/or logging requirements.

Regards,

Justin.

-----Original Message-----
From:	Matt Miller [mailto:syslog-ng at mattmillersf.fastmail.fm]
Sent:	Wed 1/3/2007 12:16 AM
To:	Syslog-ng users' and developers' mailing list
Cc:	Justin Randall
Subject:	RE: [syslog-ng] I/O error occurred while reading;           fd='4',error='Operation not permitted (1)'

> send the full output from strace without filtering specific system calls?

Attached.

Thanks for your help.