Project

General

Profile

Actions

Bug #4523

closed

Application log cannot to be re-opened when running as non-root user

Added by Jason Ish almost 3 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

Suricata by default creates an application log at /var/log/suricata/suricata.log. This log file is created before changing uid and remains owned by root. After log rotation and a subsequent command to "reopen-log-files", this file is closed, but never re-opened as it can't be opened for modification by the non-root user that Suricata is now being run as.

This does not affect Suricata event logging as those files are opened after the uid is changed.

I think the only way to handle this is to change ownership of the file before the uid change so it can be re-opened.


Related issues 2 (0 open2 closed)

Copied to Suricata - Bug #5102: Application log cannot to be re-opened when running as non-root userClosedShivani BhardwajActions
Copied to Suricata - Bug #5103: Application log cannot to be re-opened when running as non-root userClosedJeff LucovskyActions
Actions #1

Updated by Jason Ish about 2 years ago

  • Status changed from New to In Progress
  • Label Needs backport to 5.0, Needs backport to 6.0 added
Actions #2

Updated by Jason Ish about 2 years ago

  • Status changed from In Progress to In Review
Actions #3

Updated by Jason Ish about 2 years ago

  • Status changed from In Review to Closed

Merged into master.

Actions #4

Updated by Jeff Lucovsky about 2 years ago

  • Copied to Bug #5102: Application log cannot to be re-opened when running as non-root user added
Actions #5

Updated by Jeff Lucovsky about 2 years ago

  • Copied to Bug #5103: Application log cannot to be re-opened when running as non-root user added
Actions

Also available in: Atom PDF