> -----Original Message-----
> From: David Lang [mailto:[email protected]]
> Sent: Wednesday, November 07, 2018 6:43 PM
> To: LOEWENTHAL Sophie
> Cc: sophie.loewenthal--- via rsyslog
> Subject: RE: [rsyslog] rsyslogd 8.24.0 and setting file ownership and
> permissions
>
> On Wed, 7 Nov 2018, [email protected] wrote:
>
> > Hi David,
> >
> > I don't have privdrop configured. I'll add this later.
>
> privdrop is more likely to cause problems that solve them
>
> >>> did the file already exist? or was it created by rsyslog?
> > Yes these existed before. This explains why it worked before.
> >
> > I added this:
> > *.warning {
> > action(
> > type="omfile"
> > dirCreateMode="0750"
> > fileCreateMode="0640"
> > fileGroup="admin"
> > name="warnActionName"
> > file="/app/rsyslog/messages.all"
> > )
> > }
> >
> > Next I stopped rsyslog, deleted the files, and started again, but no new
> > file was
> created.
>
> rsyslog doesn't create files until there is a log that needs to go to them.
>
> rsyslog doesn't change permissions of files that already exist, it only sets
> the
> permissions of files that it is creating.
>
> David Lang
Hi David,
> rsyslog doesn't change permissions of files that already exist,
I deleted all log files and the *.info works with the correct file permissions.
Thank-you for all your & everybody else's help so far.
Question 1 : The remote servers look like they log into the *.warn file
file="/app/rsyslog/messages.all" except the actual syslog server, which does
not: # logger -t user.kern TEST logs into the *.info file but not the *.warn
/messages.all.
Question 2: Is it worth adding disk based queues for the locally logged files
below? e.g
template(name="dynaName" type="string" string="/app/rsyslog/%hostname%.log")
*.info {
action(
type="omfile"
name="infoActionName"
dynafile="dynaName"
queue.spoolDirectory="/app/rsyslog/queues"
queue.size="1024000"
queue.filename="hostname-info.queue"
queue.maxdiskspace="64m"
queue.type="FixedArray"
queue.maxfilesize="10m"
queue.saveonshutdown="on"
queue.discardseverity="7"
Action.ResumeInterval="1"
Action.ResumeRetryCount="-1"
)
}
*.warn {
action(
type="omfile"
name="warnActionName"
file="/app/rsyslog/messages.warn.all"
)
}
This message and any attachments (the "message") is
intended solely for the intended addressees and is confidential.
If you receive this message in error,or are not the intended recipient(s),
please delete it and any copies from your systems and immediately notify
the sender. Any unauthorized view, use that does not comply with its purpose,
dissemination or disclosure, either whole or partial, is prohibited. Since the
internet
cannot guarantee the integrity of this message which may not be reliable, BNP
PARIBAS
(and its subsidiaries) shall not be liable for the message if modified, changed
or falsified.
Do not print this message unless it is necessary, consider the environment.
----------------------------------------------------------------------------------------------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le "message")
sont etablis a l'intention exclusive de ses destinataires et sont confidentiels.
Si vous recevez ce message par erreur ou s'il ne vous est pas destine,
merci de le detruire ainsi que toute copie de votre systeme et d'en avertir
immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de
ce message qui n'est pas conforme a sa destination, toute diffusion ou toute
publication, totale ou partielle, est interdite. L'Internet ne permettant pas
d'assurer
l'integrite de ce message electronique susceptible d'alteration, BNP Paribas
(et ses filiales) decline(nt) toute responsabilite au titre de ce message dans
l'hypothese
ou il aurait ete modifie, deforme ou falsifie.
N'imprimez ce message que si necessaire, pensez a l'environnement.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
