At Mariusz, my apologies for not replying earlier, somehow Google Mail crunched your reply in the thread so that I did not see it (*laziness on my part I guess, I have been extremely busy at work*).
I just executed *ps -ef | egrep rsyslog* and see that rsyslog is running as root. Can I assume that I should be able to use the $FileOwner and $FileGroup directives without issue? Also sir, for clarification, when I attempt to leave those directives (in the picture provided earlier in the thread) intact and then restart rsyslogd, it simply will not successfully restart. It's bombing because of those directives. Is there any chance I am using them in an incorrect syntax context? Where can I find the documentation that is specific to my rsyslog version on the internet since the documentation is not in the RPM installed? -------------------------- Warron French On Sat, Apr 6, 2024 at 2:39 AM Mariusz Kruk via rsyslog < rsyslog@lists.adiscon.com> wrote: > Also remember that in Linux system (quoting the man 2 chown): > > Only a privileged process (Linux: one with the CAP_CHOWN > capability) may change the owner of a file. The owner of a file may > change the group of the file to any group of which that owner > is a member. A privileged process (Linux: with CAP_CHOWN) may > change the group arbitrarily. > > So if your rsyslogd is an unprivileged process (it does not have > CAP_CHOWN granted explicitly and it does not run as root user), you won' > be able to create files as a different user. > > MK > > On 6.04.2024 07:20, David Lang via rsyslog wrote: > > if you are using the action() syntax, you set the ownership as part of > > the action. > > > > if you post your full config (including included files) we can better > > guess what's wrong with it. > > > > David Lang > > > > On Sat, 6 Apr 2024, warron.french via rsyslog wrote: > > > >> I am running multiple servers on RHEL-7.9 at work and with no option to > >> upgrade to a newer major version. > >> > >> I have a server collecting (consolidating) logs from other (remote) > >> servers > >> and need to store the various independently generated logfiles but > >> also set > >> the Group-owner to something other than root. > >> > >> I thought the proper syntax to do this was to set: > >> $FileOwner somegroup > >> > >> But rsyslogd upon restart fails to accept this directive. > >> > >> Can someone tell me what directive I should be using because > >> attempting to > >> find the Rsyslog documentation specific to my RHEL-7.9 in combination to > >> answering this query at *rsyslog.com <http://rsyslog.com> * > >> is not proving to be useful. > >> > >> Thank you in advance for your assistance, > >> > >> -------------------------- > >> Warron French > >> _______________________________________________ > >> rsyslog mailing list > >> https://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > >> POST if you DON'T LIKE THAT. > >> > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > > if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
