1

I have a set of log files with the following permissions:

-rw-rw-r-- 1 club club

and my custom logroate file looks like below: 

/home/club/club/log/* {
        size 1M
        dateext
        dateformat .%Y%m%d-%s
        missingok
        rotate 1000
        compress
        notifempty
        create 0664 club club
        su club
}

but I get the error 

error: error setting owner of /home/club/club/log/club.log.2019-04-05 to uid 1002 and gid 1002: Operation not permitted

How should I handle that? I was under the impression that by setting 'su club' it would be able to do whatever it wants with the logfiles, what is missing here?

Improve this question
7
  • What if you remove su club? I don't really see a reason to use that here as the log rotation is usually run by root anyway, and you have a create statement that would recreate the log with an explicit owner and group. Commented Jul 20, 2019 at 17:24
  • 1
    it gets "error: skipping "/home/club/club/log/club.log.2019-07-13" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.", the parent directory /home/club/club/log/ has this permission: drwxrwxr-x 3 club club Commented Jul 20, 2019 at 17:32
  • Try replacing create ... by just create, as it then might not try doing the failing chown. With no args it is supposed to reproduce the old file's mode/user/group. Or perhaps use nocreate if your program will create it later. You should also consider replacing * by something that doesnt include the files that have already been rotated. Commented Jul 20, 2019 at 17:44
  • I changed it to /home/club/club/log/club.log.????-??-??{ size 1M dateext dateformat .%Y%m%d-%s missingok rotate 1000 compress notifempty su club }, it renames the files, but cannot zip it , it says: error: error setting owner of /home/club/club/log/club.log.2018-10-03.20190720-1563645565.gz to uid 1002 and gid 1002: Operation not permitted Commented Jul 20, 2019 at 18:02
  • I did some testing and noticed my config works if I provide both user and group to su, with or without create, so try su club club. Commented Jul 20, 2019 at 18:47

1 Answer 1

Reset to default
2

When using the su directive in logrotate config files, it's best practice to also specify the group.

su user group

Failure to explicitly set the group can result in unexpected behavior.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.