Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm using munin 1.4.5 on OpenSUSE 11.4. Lately logrotate was updated to fix some permission problems and after that complained with

Mar  3 12:15:05 lucien logrotate: error: "/var/log/munin" has insecure permissions. It must be owned and be writable by root only to avoid security problems. Set the "su" directive in the config file to tell logrotate which user/group should be used for rotation.
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-node.log: Bad file descriptor

So I addded su directives to /etc/logrotate.d/munin and /etc/logrotate.d/munin-node:

/var/log/munin/munin-html.log
/var/log/munin/munin-nagios.log
/var/log/munin/munin-limits.log
/var/log/munin/munin-update.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}
/var/log/munin/munin-graph.log {
    su munin www
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 660 munin www
}
/var/log/munin/munin-cgi-graph.log {
    su wwwrun munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 wwwrun www
}

/var/log/munin/munin-node.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}

Now logrotate doesn't rotate anymore.

Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error setting owner of /var/log/munin/munin-cgi-graph.log-20120305: Operation not permitted
Mar  5 12:15:05 lucien logrotate: error: error opening /var/log/munin/munin-node.log: Permission denied

An ls -la of /var/log/munin/ is here.

How do I get logrotate to work again with munin?

share|improve this question
add comment

3 Answers

There's quite a mess in your permissions in /var/log/munin and in your config file. You have different user/group pair for your files and diffrent group/pair in your configuration.

You have 2 choices in order to solve your problem

  1. Use default root:root permissions
  2. Specify in ALL your munin rules the same user/group pair

First, you can reset permissions recursively with chown :

chown -R USER:GROUP /var/log/munin

After, if you choose the second solution, you'll have to replace all su ... lines with this one :

su USER GROUP

If you choose the first solution, you'll have to remove entirely all su ... lines.

share|improve this answer
    
I have different permissions because I use munin-cgi and so some log files must be writeable by the webserver. –  Martin Schröder Mar 17 '12 at 23:51
add comment

Run logrotate manually as root with '-d' (as debug) and you will see nice talkative outout.

share|improve this answer
1  
It is: 'su' option has been added by the latest maintenance update to deal with the security issues with service owned directories: bugzilla.novell.com/… –  Petr Uzel Mar 14 '12 at 9:58
    
OK then, my logrotate is outdated :) –  Jiri Xichtkniha Mar 14 '12 at 10:53
add comment
up vote 0 down vote accepted

Turns out this was a bug introduced in logrotate-3.7.9-6.9.1 and fixed in logrotate-3.7.9-6.12.1.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.