Give zabbix agent read permissions on root log files

[mitch2k]

Hi,

I'm running zabbix-agent on a centos 7 machine under user/group zabbix. I want to give the zabbix user access to a couple of log files in folders under:


/var/log
/usr/local/cpanel/logs/

What is the best way to give that user access to those files. Since for example /var/log/messages is owned by root, I can't just chmod the files to zabbix. Also running the zabbix agent under root sounds like a bad plan.

What is the best approach? should I use setfacl? If I use setfacl, should I add rights to all preceding folders as well?

Thanks

[tcilmo]

Hi,

I'm running zabbix-agent on a centos 7 machine under user/group zabbix. I want to give the zabbix user access to a couple of log files in folders under:


/var/log
/usr/local/cpanel/logs/

What is the best way to give that user access to those files. Since for example /var/log/messages is owned by root, I can't just chmod the files to zabbix. Also running the zabbix agent under root sounds like a bad plan.

What is the best approach? should I use setfacl? If I use setfacl, should I add rights to all preceding folders as well?

Thanks

If you can gather the data you need with a script or one-liner of sorts - use a UserParameter to "sudo" as needed to collect the data.

For example:
UserParameter=sumd5sum[*],sudo /usr/bin/md5sum $1 | cut -f1 -d' '

We use this to check files that Zabbix does not have access to.

Then /etc/sudoers.d/zabbix-agent lists what commands zabbix is allowed to sudo without password

Hope this helps!