cannot monitor a log file for permission denied

[bab]

I have a log file that owner of file is oracle . Now want t o monitor that log file with zabbix but it is showing :
Cannot obtain information for file "/home/web.log": [13] Permission denied

what should I do now ?

[Moob]

Hi,

Give the account under which the zabbix agent is running read access to the file you want to monitor.

Regard

[bab]

Hi,

Give the account under which the zabbix agent is running read access to the file you want to monitor.

Regard

This is my output from zabbix-agent2 .

[root@server ~]# systemctl status zabbix-agent2.service
● zabbix-agent2.service - Zabbix Agent 2
Loaded: loaded (/usr/lib/systemd/system/zabbix-agent2.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2024-11-23 13:38:16 +0330; 5 months 3 days ago
Process: 27084 ExecStop=/bin/kill -SIGTERM $MAINPID (code=exited, status=0/SUCCESS)
Main PID: 27087 (zabbix_agent2)
Tasks: 14
CGroup: /system.slice/zabbix-agent2.service
└─27087 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
[root@server ~]# ps -ef | grep 27087
root 24633 23650 0 08:56 pts/0 00:00:00 grep --color=auto 27087
zabbix 27087 1 0 2024 ? 18:35:52 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
​

Also this is my log file

/home/web.log

What should I do now ?

[cyber]

Find a friendly linux admin, who knows, what is "setfacl" and let him/her resolve your permission issue...
Or start from here for example.. https://www.redhat.com/en/blog/linux...ions-explained and work your way forward ...

[bab]

Find a friendly linux admin, who knows, what is "setfacl" and let him/her resolve your permission issue...
Or start from here for example.. https://www.redhat.com/en/blog/linux...ions-explained and work your way forward ...

We used follow command but it is still show permission :

Cannot obtain information for file "/home/logs/web.log": [13] Permission denied

setfacl -Rdm u::rwx,g::r,o::r /home/logs/

[mrnobody]

Try this O.S level solutions

chown zabbix /home/logs/web.log
chmod +rw /home/logs/web.log

chown = change owner to zabbix
chmod = change mode, using +rw (read and write)

[bab]

Try this O.S level solutions

chown zabbix /home/logs/web.log
chmod +rw /home/logs/web.log

chown = change owner to zabbix
chmod = change mode, using +rw (read and write)

Thanks. but the file owner currently is

-rw-r--r--. 1 oracle oinstall 6.4M Apr 29 09:07 /home/logs/web.log

if we change thw owner from oracle to zabbix I think may disrupt and could not write log logs in the file with oracle user.

[mrnobody]

Oracle Linux?! If it's; RHel based OS's are so secure, that block who works with their tech.
Or it's Oracle DB? Wish you luck and patience

[cyber]

Try this O.S level solutions

chown zabbix /home/logs/web.log
chmod +rw /home/logs/web.log

chown = change owner to zabbix
chmod = change mode, using +rw (read and write)

one should not change owner of files so easily... You will screw someone else with that...

bab can you share the output of following "namei -mo /home/logs/web.log" . This should display permissions for whole path...
After that we should be able to give you some pointers for setfacl...

[bab]

one should not change owner of files so easily... You will screw someone else with that...

bab can you share the output of following "namei -mo /home/logs/web.log" . This should display permissions for whole path...
After that we should be able to give you some pointers for setfacl...

This is my output :

[root@ser~]# namei -mo /u01/fus/mdw/Oracle_Home/user_projects/domains/ser_domain/servers/AdminServer/logs/web.log
f: /u01/fus/mdw/Oracle_Home/user_projects/domains/ser_domain/servers/AdminServer/logs/web.log
 dr-xr-xr-x root   root     /
 drwxrwxr-x oracle oinstall u01
 drwxrwxr-x oracle oinstall fus
 drwxrwxr-x oracle oinstall mdw
 drwxr-x--- oracle oinstall Oracle_Home
 drwxr-x--- oracle oinstall user_projects
 drwxr-x--- oracle oinstall domains
 drwxr-x--- oracle oinstall ser_domain
 drwxr-x--- oracle oinstall servers
 drwxr-x--- oracle oinstall AdminServer
 drwxr-xr-x oracle oinstall logs
 -rw-r--r-- oracle oinstall web.log

[Moob]

Hi,

If I read your output correctly the web.log file as read access for owner,group and others. The Zabbix agent runs per default with/under the Zabbix user account, as per Zabbix documentation.

Now the logs folder has the same read access but the folders above that have not. They only have read rights for the owner and group.
So, instead off to mess with the already present access rights, which I do not advise, you might try to add the zabbix user to the group oinstall. This group already has read access throughout the whole directory structure.
A quick search let me to this

https://docs.oracle.com/cd/E11857_01/install.111/e15838/appdx_creating_os_grps_usrs.htm

The oinstall group is used during a Oracle installation, however, I have no idea what and where this group is being used for within a Oracle configuration.

My advise would be to first consult the admin of that particular system before you make any changes to group membership. Than test if adding the zabbix user to that group and see if you can read that log file.

Regards

[cyber]

[root@ser~]# namei -mo /u01/fus/mdw/Oracle_Home/user_projects/domains/ser_domain/servers/AdminServer/logs/web.log
f: /u01/fus/mdw/Oracle_Home/user_projects/domains/ser_domain/servers/AdminServer/logs/web.log
dr-xr-xr-x root root /
drwxrwxr-x oracle oinstall u01
drwxrwxr-x oracle oinstall fus
drwxrwxr-x oracle oinstall mdw
drwxr-x--- oracle oinstall Oracle_Home
drwxr-x--- oracle oinstall user_projects
drwxr-x--- oracle oinstall domains
drwxr-x--- oracle oinstall ser_domain
drwxr-x--- oracle oinstall servers
drwxr-x--- oracle oinstall AdminServer
drwxr-xr-x oracle oinstall logs
-rw-r--r-- oracle oinstall web.log

From here you can see, that "Others" can get to /u01/fus/mdw But from there "Oracle_home" already has no permissions for others. That means, zabbix, being a completely ordinary user, does not get into those directories... and having r-x only somewhere in the end of path like "logs", does not make any difference...
Easiest thing to do would be, as Moob suggested, put zabbix in usergroup "oinstall", then it will have all the permissions to read that logfile. But, ask your Oracle ppl, what they have to say about this...
if you want to go by acl route, then ...

Running "setfacl -m u:zabbix:rx <directory>" for each directory in the path to logfiles gives user "zabbix" access to logfile directory. Running setfacl with -R option (recursive) can give too wide reading rights in whole tree, so be careful. For the last directory you need to run also "setfacl -dR -m u:zabbix:rx <folder>". -d option gives "default" access rights to all newly created files in that directory, so rotation of files etc does not remove access rights to files. Currently present files do not get any access restrictions changed unless you use setfacl command towrds them (setfacl -m u:zabbix:r <file>) or you may need to wait (until next day maybe) until files rotate and new file inherits permissions from "default" directory access.

This can be executed as file owner also, so you don't always need to run to your friendly sysadmin. But if this did not make any sense to you, please ask specialist to do it..