1

Why am I getting permission denied on renaming my log file when running logrotate? The owner of my log file shown below is rajohns which is the same user that is logged in running the logrotate command shown below.

$ cat /etc/logrotate.d/judgecard-api-0.0.1

/var/log/judgecard-api-0.0.1.log {
    su rajohns rajohns
    weekly
    rotate 4
    create 0777 rajohns rajohns
    missingok
    notifempty
    postrotate
        systemctl restart judgecard-api-0.0.1.service > /dev/null
    endscript
}

$ ls -l /var/log/judgecard-api-0.0.1.log

-rwxrwxrwx 1 rajohns rajohns 10578 Feb 12 23:01 /var/log/judgecard-api-0.0.1.log

$ sudo logrotate -vf -s ~/logrotate_test_status_file judgecard-api-0.0.1

reading config file judgecard-api-0.0.1

Handling 1 logs

rotating pattern: /var/log/judgecard-api-0.0.1.log  forced from command line (4 rotations)
empty log files are not rotated, old logs are removed
switching euid to 1000 and egid to 1000
considering log /var/log/judgecard-api-0.0.1.log
  log needs rotating
rotating log /var/log/judgecard-api-0.0.1.log, log->rotateCount is 4
dateext suffix '-20180212'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/judgecard-api-0.0.1.log.4 to /var/log/judgecard-api-0.0.1.log.5 (rotatecount 4, logstart 1, i 4), 
old log /var/log/judgecard-api-0.0.1.log.4 does not exist
renaming /var/log/judgecard-api-0.0.1.log.3 to /var/log/judgecard-api-0.0.1.log.4 (rotatecount 4, logstart 1, i 3), 
old log /var/log/judgecard-api-0.0.1.log.3 does not exist
renaming /var/log/judgecard-api-0.0.1.log.2 to /var/log/judgecard-api-0.0.1.log.3 (rotatecount 4, logstart 1, i 2), 
old log /var/log/judgecard-api-0.0.1.log.2 does not exist
renaming /var/log/judgecard-api-0.0.1.log.1 to /var/log/judgecard-api-0.0.1.log.2 (rotatecount 4, logstart 1, i 1), 
old log /var/log/judgecard-api-0.0.1.log.1 does not exist
renaming /var/log/judgecard-api-0.0.1.log.0 to /var/log/judgecard-api-0.0.1.log.1 (rotatecount 4, logstart 1, i 0), 
old log /var/log/judgecard-api-0.0.1.log.0 does not exist
log /var/log/judgecard-api-0.0.1.log.5 doesn't exist -- won't try to dispose of it
renaming /var/log/judgecard-api-0.0.1.log to /var/log/judgecard-api-0.0.1.log.1
error: failed to rename /var/log/judgecard-api-0.0.1.log to /var/log/judgecard-api-0.0.1.log.1: Permission denied
switching euid to 0 and egid to 0
  • 1
    Do you have write permission in /var/log with user rajohns? – Ipor Sircer Feb 13 '18 at 6:27
3

Obviously the /var/log rotate fails, as the directory normally belongs to root:adm.

You can have a look at Apache and others to see how they do it.

The usual way of doing it is creating a subdirectory under /var/log and making another user the owner of it:

 sudo mkdir /var/log/judgecards
 chown rajohns /var/log/judgecards

Then move the old logs and create new logs of your app here.

  • This worked. I'm still a little confused though. I was able to manually create/rename files in /var/log with rajohns, so why couldn't logrotate do it when run from rajohns? – Adam Johns Feb 14 '18 at 15:51
  • root can create a file and give it to rajohns under /var/log ; then rajohns will be able to use it. However, unless you messed around with /var/log default permissions, rajohns cannot create new files there. – Rui F Ribeiro Feb 14 '18 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.