1

I have a set of log files with the following permissions:

-rw-rw-r-- 1 club club

and my custom logroate file looks like below:

/home/club/club/log/* {
        size 1M
        dateext
        dateformat .%Y%m%d-%s
        missingok
        rotate 1000
        compress
        notifempty
        create 0664 club club
        su club
}

but I get the error

error: error setting owner of /home/club/club/log/club.log.2019-04-05 to uid 1002 and gid 1002: Operation not permitted

How should I handle that? I was under the impression that by setting 'su club' it would be able to do whatever it wants with the logfiles, what is missing here?

7
  • What if you remove su club? I don't really see a reason to use that here as the log rotation is usually run by root anyway, and you have a create statement that would recreate the log with an explicit owner and group.
    – Kusalananda
    Jul 20, 2019 at 17:24
  • 1
    it gets "error: skipping "/home/club/club/log/club.log.2019-07-13" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.", the parent directory /home/club/club/log/ has this permission: drwxrwxr-x 3 club club
    – Alex
    Jul 20, 2019 at 17:32
  • Try replacing create ... by just create, as it then might not try doing the failing chown. With no args it is supposed to reproduce the old file's mode/user/group. Or perhaps use nocreate if your program will create it later. You should also consider replacing * by something that doesnt include the files that have already been rotated.
    – meuh
    Jul 20, 2019 at 17:44
  • I changed it to /home/club/club/log/club.log.????-??-??{ size 1M dateext dateformat .%Y%m%d-%s missingok rotate 1000 compress notifempty su club }, it renames the files, but cannot zip it , it says: error: error setting owner of /home/club/club/log/club.log.2018-10-03.20190720-1563645565.gz to uid 1002 and gid 1002: Operation not permitted
    – Alex
    Jul 20, 2019 at 18:02
  • I did some testing and noticed my config works if I provide both user and group to su, with or without create, so try su club club.
    – meuh
    Jul 20, 2019 at 18:47

1 Answer 1

2

When using the su directive in logrotate config files, it's best practice to also specify the group.

su user group

Failure to explicitly set the group can result in unexpected behavior.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .