I see my file permissions are changing automatically , to test I have kept the permssions chmod 750 to all alert file in /var/log/snort-* after some time when alert file updated the permission got changed automatically please seethe bold ones below
find /var/log/ -name "alert" | xargs ls -ltr -rw-r----- 1 root root 0 Jan 2 20:31 /var/log/snort/alert -rwxr-x--- 1 snort snort 34072366 Feb 1 16:27 /var/log/snort-28/alert -rwxr-x--- 1 snort snort 75063436 Feb 1 16:27 /var/log/snort-19/alert -rwxr-x--- 1 snort snort 16311468 Feb 1 16:27 /var/log/snort-30/alert -rwxr-x--- 1 snort snort 79884541 Feb 1 16:27 /var/log/snort-16/alert -rwxr-xr-x 1 snort snort 104905721 Feb 1 16:27 /var/log/snort-1/alert -rwxr-x--- 1 snort snort 34544347 Feb 1 16:27 /var/log/snort-24/alert -rwxr-xr-x 1 snort snort 93270532 Feb 1 16:27 /var/log/snort-0/alert -rw------- 1 snort snort 398030 Feb 1 16:27 /var/log/snort-27/alert -rwxr-x--- 1 snort snort 124223452 Feb 1 16:27 /var/log/snort-8/alert -rwxr-x--- 1 snort snort 70808479 Feb 1 16:27 /var/log/snort-5/alert -rwxr-x--- 1 snort snort 36275553 Feb 1 16:27 /var/log/snort-15/alert -rwxr-x--- 1 snort snort 17365347 Feb 1 16:27 /var/log/snort-9/alert -rwxr-x--- 1 snort snort 112000757 Feb 1 16:27 /var/log/snort-12/alert -rwxr-x--- 1 snort snort 57244741 Feb 1 16:27 /var/log/snort-4/alert -rwxr-x--- 1 snort snort 33943973 Feb 1 16:27 /var/log/snort-7/alert -rwxr-x--- 1 snort snort 7480744 Feb 1 16:28 /var/log/snort-11/alert -rwxr-x--- 1 snort snort 120967271 Feb 1 16:28 /var/log/snort-21/alert -rwxr-x--- 1 snort snort 39321621 Feb 1 16:28 /var/log/snort-13/alert -rwxr-xr-x 1 snort snort 78907524 Feb 1 16:28 /var/log/snort-2/alert -rwxr-x--- 1 snort snort 120505554 Feb 1 16:28 /var/log/snort-10/alert -rwxr-x--- 1 snort snort 123510708 Feb 1 16:28 /var/log/snort-22/alert -rwxr-x--- 1 snort snort 37705193 Feb 1 16:28 /var/log/snort-20/alert -rwxr-x--- 1 snort snort 17115219 Feb 1 16:28 /var/log/snort-6/alert -rwxr-x--- 1 snort snort 19318806 Feb 1 16:28 /var/log/snort-23/alert -rwxr-x--- 1 snort snort 11678050 Feb 1 16:28 /var/log/snort-14/alert -rw------- 1 snort snort 2813938 Feb 1 16:28 /var/log/snort-18/alert -rwxr-x--- 1 snort snort 11182293 Feb 1 16:28 /var/log/snort-3/alert -rw------- 1 snort snort 2231847 Feb 1 16:28 /var/log/snort-29/alert -rwxr-x--- 1 snort snort 38157904 Feb 1 16:28 /var/log/snort-25/alert -rwxr-x--- 1 snort snort 20220138 Feb 1 16:28 /var/log/snort-26/alert -rwxr-x--- 1 snort snort 122715343 Feb 1 16:28 /var/log/snort-17/alert -rwxr-x--- 1 snort snort 120842518 Feb 1 16:28 /var/log/snort-31/alert
[root@jumpo1 snort-1]# grep snort /etc/group snort:x:40000:logstash,root
Any clue why this is happening how to preserve permssions I want to be keep chmod 750 to all alert files, no one should change that even root.
I am using linux version
[root@jumpo1 snort-1]# uname -a Linux jumpo1 3.10.0-514.el7.x86_64 x86_64 x86_64 x86_64 GNU/Linux
