Zabbix Monitor Centos Log

[radu990]

Hi,

I'm trying to monitor the Centos 7 log [/var/log/messages] from my zabbix server and created a item for this.

However, I received the below error in the agent log:

Cannot open file "/var/log/messages": [13] Permission denied

I understand the problem is in the access to the log file, as only root/admins have access to log files. Had the same problem on Ubuntu, and solved it with adding the zabbix user to admin group

sudo usermod -aG adm zabbix

Same command doesn't help/work on Centos. Any help/ideas on how to grant permission to zabbix user to access logs?

http://www.pixhost.org/show/154/55167560_clipboard.png

Thank you

[kaspars.mednis]

The default permissions on messages log file allows only root:root

-rw-------.  1 root   root   531934 okt 25 02:52 messages

In that case easy and fast way to solve this:

chgrp zabbix /var/log/messages
chmod g+r messages

Basically this will allow anyone in the zabbix group read the log file. zabbix is the only user here by default.

The only problem is logrotate, which will remove this logfile and create new with default permissions.

so you must specify in logrotate conf options for /var/log/messages, otherwise after some time the log will be rotated and new logfile will be created without zabbix read permissions

add this option for messages:

create 0640 root zabbix

Regards,
Kaspars

[radu990]

The only problem is logrotate, which will remove this logfile and create new with default permissions.

so you must specify in logrotate conf options for /var/log/messages, otherwise after some time the log will be rotated and new logfile will be created without zabbix read permissions

add this option for messages:

create 0640 root zabbix

Regards,
Kaspars

First of all, thank you very much. Everything works ok now.
One more additional question regarding logrotate conf. Do you mean to add in /etc/logrotate.conf in the create new log files section the root and zabbix users and 640 access rights? Did I understood you correctly?

http://www.pixhost.org/show/156/55180536_screenshot-2017-10-27-001.png

Thank you once again

[kaspars.mednis]

Your configuration will change the default configuration for ALL rotated logfiles with

create 0640 root zabbix

On Centos 7 if you want to change it just for system files -

in /etc/logrotate.d/ is file named syslog

originally it looks like

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
	/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

just add

create 0640 root zabbix

somewhere between brackets.

this config will be effective only on log files listed above.
Then you can remove it from global config

Regards,
Kaspars

[radu990]

Thank you very much once again!

[MalySzaryCzlowiek]

Hi i have same problem with permissions. I tried this way:

In that case easy and fast way to solve this:

chgrp zabbix /var/log/messages
chmod g+r messages

But changed path to mine (/var/log/klienci/zabbixcl/logi) and still nothing, permissions denied. All works fine when i change to chmod 777, but i know this is not safe way to solve this. Any idea what to do with this? Thanks.