5

I'm using munin 1.4.5 on OpenSUSE 11.4. Lately logrotate was updated to fix some permission problems and after that complained with

Mar  3 12:15:05 lucien logrotate: error: "/var/log/munin" has insecure permissions. It must be owned and be writable by root only to avoid security problems. Set the "su" directive in the config file to tell logrotate which user/group should be used for rotation.
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-node.log: Bad file descriptor

So I addded su directives to /etc/logrotate.d/munin and /etc/logrotate.d/munin-node:

/var/log/munin/munin-html.log
/var/log/munin/munin-nagios.log
/var/log/munin/munin-limits.log
/var/log/munin/munin-update.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}
/var/log/munin/munin-graph.log {
    su munin www
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 660 munin www
}
/var/log/munin/munin-cgi-graph.log {
    su wwwrun munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 wwwrun www
}

/var/log/munin/munin-node.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}

Now logrotate doesn't rotate anymore.

Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error setting owner of /var/log/munin/munin-cgi-graph.log-20120305: Operation not permitted
Mar  5 12:15:05 lucien logrotate: error: error opening /var/log/munin/munin-node.log: Permission denied

An ls -la of /var/log/munin/ is here.

How do I get logrotate to work again with munin?

2

There's quite a mess in your permissions in /var/log/munin and in your config file. You have different user/group pair for your files and diffrent group/pair in your configuration.

You have 2 choices in order to solve your problem

  1. Use default root:root permissions
  2. Specify in ALL your munin rules the same user/group pair

First, you can reset permissions recursively with chown :

chown -R USER:GROUP /var/log/munin

After, if you choose the second solution, you'll have to replace all su ... lines with this one :

su USER GROUP

If you choose the first solution, you'll have to remove entirely all su ... lines.

  • I have different permissions because I use munin-cgi and so some log files must be writeable by the webserver. – Martin Schröder Mar 17 '12 at 23:51
1

Run logrotate manually as root with '-d' (as debug) and you will see nice talkative outout.

  • 1
    It is: 'su' option has been added by the latest maintenance update to deal with the security issues with service owned directories: bugzilla.novell.com/… – Petr Uzel Mar 14 '12 at 9:58
  • OK then, my logrotate is outdated :) – jirib Mar 14 '12 at 10:53
0

Turns out this was a bug introduced in logrotate-3.7.9-6.9.1 and fixed in logrotate-3.7.9-6.12.1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.