Centos 7 restart rsyslog show "imfile: on startup file '/root/test_one.log' does not exist", actually it existed before

Issues related to applications and software problems
Post Reply
mitolH
Posts: 1
Joined: 2019/11/03 12:08:51

Centos 7 restart rsyslog show "imfile: on startup file '/root/test_one.log' does not exist", actually it existed before

Post by mitolH » 2019/11/03 12:14:28

Steps to reproduce the behavior
1. add file /etc/rsyslog.d/test_one.conf:

Code: Select all

# Config for file input test
$ModLoad imfile

$InputFileName /root/test_one.log
$InputFileTag  test_one:
$InputFileSeverity notice
$InputFileStateFile  state_test_one
$InputFilePersistStateInterval  25000
$InputFileFacility local0
$InputRunFileMonitor

local0.* /var/log/test_one.log
&~
2. create a crontab */1 * * * * /bin/date >> /root/test_one.log
3.restart services

Code: Select all

systemctl restart systemd-journald.socket
systemctl restart rsyslog
3. then systemctl status rsyslog -l show the message

Code: Select all

Nov 03 06:17:34 192-168-123-218 rsyslogd[104982]: imfile: on startup file '/root/test_one.log' does not exist but is configured in static file monitor - this may indicate a misconfiguration. If the file appears at a later time, it will automatically be processed. Reason: Permission denied [v8.24.0-34.el7]
By the way, also I had tried to stop service use systemctl stop rsyslog, just use simple command as folllow /usr/sbin/rsyslogd -n -f /etc/rsyslog.conf the log was ran will. So I can't sure is this a issuse for centos or rsyslog.

Environment
rsyslog version: v8.24.0-34.el7
platform: CentOS Linux release 7.6.1810 (Core), kernel 3.10.0-957.10.1.el7.x86_64

User avatar
TrevorH
Site Admin
Posts: 33202
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Centos 7 restart rsyslog show "imfile: on startup file '/root/test_one.log' does not exist", actually it existed bef

Post by TrevorH » 2019/11/03 14:24:05

platform: CentOS Linux release 7.6.1810 (Core), kernel 3.10.0-957.10.1.el7.x86_64
Run yum update - you are several months behind on maintenance. 7.7 has been out for about 2 months and you're missing months of fixes that came out for 7.6 too.

I would be approximately 98% sure that what you're trying to do will be stopped by selinux. The rsyslog daemon almost certainly is not allowed to write to /root at all by selinux. Log files belong under /var/log not /root.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

Post Reply