[SOLVED] Rsyslog issue and auth.log permissions

[Paspao]

Hello,

this is first time it happens to me.

Installed Proxmox 6 on OVH dedicated server.

In syslog I found:

Feb 13 12:15:32 proxmox rsyslogd: action 'action-1-builtin:omfile' resumed (module 'builtin:omfile') [v8.1901.0 try https://www.rsyslog.com/e/2359 ]
Feb 13 12:15:32 proxmox rsyslogd: file '/var/log/auth.log': open error: Operation not permitted [v8.1901.0 try https://www.rsyslog.com/e/2433 ]
Feb 13 12:15:32 proxmox rsyslogd: action 'action-1-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]

I noticed auth.log has no adm group and is 644 instead of 640 as other servers.

stat /var/log/auth.log

  File: /var/log/auth.log
  Size: 0             Blocks: 0          IO Block: 4096   regular empty file
Device: 902h/2306d    Inode: 1051086     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2020-02-13 10:29:27.272671274 +0100
Modify: 2020-02-07 19:27:41.603503887 +0100
Change: 2020-02-07 19:27:41.603503887 +0100
 Birth: -

Version: pve-manager/6.1-7/13e58d5e (running kernel: 5.3.18-1-pve)


Can't chgrp or chmod auth.log as root , I get : Operation not permitted

Any Hints ?

Thank you
P.

 

[Paspao]

Solved.

It was a simple file attribute issue solved with chattr.