5

I'm using munin 1.4.5 on OpenSUSE 11.4. Lately logrotate was updated to fix some permission problems and after that complained with

Mar  3 12:15:05 lucien logrotate: error: "/var/log/munin" has insecure permissions. It must be owned and be writable by root only to avoid security problems. Set the "su" directive in the config file to tell logrotate which user/group should be used for rotation.
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-node.log: Bad file descriptor

So I addded su directives to /etc/logrotate.d/munin and /etc/logrotate.d/munin-node:

/var/log/munin/munin-html.log
/var/log/munin/munin-nagios.log
/var/log/munin/munin-limits.log
/var/log/munin/munin-update.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}
/var/log/munin/munin-graph.log {
    su munin www
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 660 munin www
}
/var/log/munin/munin-cgi-graph.log {
    su wwwrun munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 wwwrun www
}

/var/log/munin/munin-node.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}

Now logrotate doesn't rotate anymore.

Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error setting owner of /var/log/munin/munin-cgi-graph.log-20120305: Operation not permitted
Mar  5 12:15:05 lucien logrotate: error: error opening /var/log/munin/munin-node.log: Permission denied

An ls -la of /var/log/munin/ is here.

How do I get logrotate to work again with munin?

3 Answers 3

2

There's quite a mess in your permissions in /var/log/munin and in your config file. You have different user/group pair for your files and diffrent group/pair in your configuration.

You have 2 choices in order to solve your problem

  1. Use default root:root permissions
  2. Specify in ALL your munin rules the same user/group pair

First, you can reset permissions recursively with chown :

chown -R USER:GROUP /var/log/munin

After, if you choose the second solution, you'll have to replace all su ... lines with this one :

su USER GROUP

If you choose the first solution, you'll have to remove entirely all su ... lines.

1
  • I have different permissions because I use munin-cgi and so some log files must be writeable by the webserver. Mar 17, 2012 at 23:51
1

Run logrotate manually as root with '-d' (as debug) and you will see nice talkative outout.

2
  • 1
    It is: 'su' option has been added by the latest maintenance update to deal with the security issues with service owned directories: bugzilla.novell.com/…
    – Petr Uzel
    Mar 14, 2012 at 9:58
  • OK then, my logrotate is outdated :)
    – jirib
    Mar 14, 2012 at 10:53
0

Turns out this was a bug introduced in logrotate-3.7.9-6.9.1 and fixed in logrotate-3.7.9-6.12.1.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .