Rsyslog – Setting Read and Write Permissions for Group and Everyone

centos7rsyslogsyslog

Rsyslog ignores read and write permission set with fileCreateMode for group and everyone.

I have set up a service to run my node application as such:

...
[Service]
WorkingDirectory=/opt/demo/app
User=appuser
Type=simple
ExecStart=/usr/bin/node myapp.js demo
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=myapp
...

Then I setup a myapp.conf file in /etc/rsyslog.d/ like this

if ($programname == 'myapp') then {
    action(
        type="omfile"
        File="/opt/demo/app/app.log"
        fileCreateMode="0640"
        fileOwner="appuser"
        fileGroup="mygroup"
    )
    stop
}

The log file gets created with the correct user and group but with 0600 permissions instead of 0640.

If I change fileCreateMode to 0777 then the file gets created with 0711.

I am using default rsyslog.conf, rsyslog version is 8.24.0-41, OS is CentOS 7.7

rsyslogd -N 1 does not throw any errors

Best Answer

If your rsyslogd is being started by systemd then your service definition, /usr/lib/systemd/system/rsyslog.service, probably contains a UMask restiction:

UMask=0066

This breaks any config in the rsyslogd.conf relating to masks and modes.

Related Topic