What distro? Do you have SE linux or equivalent installed? If so, check your auditd messages.
Check Status * # aa-status * # sestatus Check Logs * # systemctl restart rsyslog && aa-logprof * # systemctl restart rsyslog && ausearch -m avc -ts recent Cheers, Mike ________________________________ From: rsyslog <rsyslog-boun...@lists.adiscon.com> on behalf of Mårten Persson via rsyslog <rsyslog@lists.adiscon.com> Sent: Saturday, January 11, 2025 9:15 PM To: rsyslog@lists.adiscon.com <rsyslog@lists.adiscon.com> Cc: Mårten Persson <mar...@m-aero.se> Subject: [rsyslog] omprog CAUTION: The Sender is located Outside The Organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hello everybody, I updated my distro and after that omprog lacks rights... The config and the scripts have been working flawlessly for a long time :-) The error message: rsyslogd: omprog: failed to execute program '/usr/local/bin/fanvil.sh': Permission denied The file with permissions: -rwxr-xr-x 1 syslog adm 3458 Nov 8 22:18 fanvil.sh* And finally rsyslogd: systemd+ 5552 0.0 0.0 154412 2900 ? Ssl Jan03 0:00 /usr/sbin/rsyslogd syslog 389972 0.0 0.0 235824 4980 ? Ssl Jan05 0:00 rsyslogd syslog 1678535 0.0 0.0 378668 5632 ? Ssl 05:51 0:00 /usr/sbin/rsyslogd -n -iNONE SO user syslog runs rsyslogd, the file that omprog shuld execute is owned by syslog with execute rights. What am I missing here ? Thank you for any help / pointers Mårten _______________________________________________ rsyslog mailing list https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cd17a0642178448f5c45208dd3228e8d8%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C1%7C638721873525609200%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C80000%7C%7C%7C&sdata=voQ576TuYBlLZUBLcoEw21uNYanyNicvajMkbPiqgrw%3D&reserved=0<https://lists.adiscon.net/mailman/listinfo/rsyslog> https://can01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cd17a0642178448f5c45208dd3228e8d8%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C1%7C638721873525625413%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C80000%7C%7C%7C&sdata=Upuk2MvPVo5eLU2f2GfFXYFm%2FU5L9XT6JRihcHJv0h0%3D&reserved=0<http://www.rsyslog.com/professional-services/> What's up with rsyslog? Follow https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cd17a0642178448f5c45208dd3228e8d8%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C1%7C638721873525637773%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C80000%7C%7C%7C&sdata=93PwdvDW4xQWdAYJKCdY3jRSvBIjkMHDg2j%2Bcb%2BkhhI%3D&reserved=0<https://twitter.com/rgerhards> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ________________________________________ This e-mail communication (including any or all attachments) is intended only for the use of the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this e-mail, any use, review, retransmission, distribution, dissemination, copying, printing, or other use of, or taking of any action in reliance upon this e-mail, is strictly prohibited. If you have received this e-mail in error, please contact the sender and delete the original and any copy of this e-mail and any printout thereof, immediately. If you have any questions or concerns, please contact our Customer Service Desk at 1-877-274-2349. Your co-operation is appreciated. Le présent courriel (y compris toute pièce jointe) s'adresse uniquement à son destinataire, qu'il soit une personne ou un organisme, et pourrait comporter des renseignements privilégiés ou confidentiels. Si vous n'êtes pas le destinataire du courriel, il est interdit d'utiliser, de revoir, de retransmettre, de distribuer, de disséminer, de copier ou d'imprimer ce courriel, d'agir en vous y fiant ou de vous en servir de toute autre façon. Si vous avez reçu le présent courriel par erreur, prière de communiquer avec l'expéditeur et d'éliminer l'original du courriel, ainsi que toute copie électronique ou imprimée de celui-ci, immédiatement. Si vous avez des questions ou des préoccupations, veuillez contacter notre centre de service à la clientèle au 1-877-274-2349. Nous sommes reconnaissants de votre collaboration. ________________________________________ _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
