check-log copies the log file to /var/cache/ and truncates it every second..

Sensu Classic (EOL)
1

I am using sensu-plugins-logs, check-log

To get this working, I had to add sensu user to the adm group so that I can address /var/log/auth.log. But for some reason I started to get Permission Denied for /var/cache/check-log/…/var/log/auth.log. I had to give chmod 777 access (without -R) to /var/cache/check-log/.../var/log/auth.log to get it to work. Ideally adding sensu user to root group should have done the trick.

Issue 1

Please help me solve this issue without having to do chmod on /var/cache/check-log/.../var/log/auth.log.

Issue 2

Very funny :slight_smile:

tail on /var/cache/check-log/…/var/log/auth.log reports
9333715tail: /var/cache/check-log/default/var/log/auth.log: file truncated
9333715tail: /var/cache/check-log/default/var/log/auth.log: file truncated
9333715tail: /var/cache/check-log/default/var/log/auth.log: file truncated

I am lost.

2

Changing a linux user’s group membership (sensu added to the root group) requires a restart of any process running as that user. Did you restart the sensu client afterwards?

Adding sensu to the root group is a big overkill. Have you considered using sudo instead?

Regarding the permissions on /var/cache/check-log, are you testing the command as the root user, which is creating these files as root?

https://github.com/sensu-plugins/sensu-plugins-logs/blob/master/bin/check-log.rb#L207

Try running your tests as the sensu user to get consistent results. (or use sudo)

···

On Wed, Feb 15, 2017 at 5:47 AM, Siddharth Jagtiani jsiddharth@mcruiseon.com wrote:

I am using sensu-plugins-logs, check-log

To get this working, I had to add sensu user to the adm group so that I can address /var/log/auth.log. But for some reason I started to get Permission Denied for /var/cache/check-log/…/var/log/auth.log. I had to give chmod 777 access (without -R) to /var/cache/check-log/.../var/log/auth.log to get it to work. Ideally adding sensu user to root group should have done the trick.

Issue 1

Please help me solve this issue without having to do chmod on /var/cache/check-log/.../var/log/auth.log.

Issue 2

Very funny :slight_smile:

tail on /var/cache/check-log/…/var/log/auth.log reports
9333715tail: /var/cache/check-log/default/var/log/auth.log: file truncated
9333715tail: /var/cache/check-log/default/var/log/auth.log: file truncated
9333715tail: /var/cache/check-log/default/var/log/auth.log: file truncated

I am lost.