# \[auditbeats\]\[beats\] File permissions for file output not working

**URL:** <https://discuss.elastic.co/t/auditbeats-beats-file-permissions-for-file-output-not-working/219661>\
**Category:** Beats\
**Created:** [February 17, 2020, 5:04pm UTC](https://discuss.elastic.co/t/auditbeats-beats-file-permissions-for-file-output-not-working/219661 "2020-02-17T17:04:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomrade/32/26626_2.png) [@tomrade](https://discuss.elastic.co/u/tomrade)\
**Post date:** [February 17, 2020, 5:04pm UTC](https://discuss.elastic.co/t/auditbeats-beats-file-permissions-for-file-output-not-working/219661/1 "2020-02-17T17:04:17Z")

</div>

In the file output we can specify a permission string for the files. I use auditbeat and although I set the string to "0644". The created file is still "0600" when I "ls" this. file, ive not be able to change this ive tried deleting the file and then recreating etc. I was going to create an issue on github, but put this here first to see if anyone has any ideas

---

<div class="post-metadata">

**Author:** ![tomrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomrade/32/26626_2.png) [@tomrade](https://discuss.elastic.co/u/tomrade)\
**Post date:** [February 17, 2020, 5:51pm UTC](https://discuss.elastic.co/t/auditbeats-beats-file-permissions-for-file-output-not-working/219661/2 "2020-02-17T17:51:12Z")

</div>

Ive played about some more and I can get it change with different values. I thought it could be a umask so tried 0000, 000, 0022 and 022 , but those resulted in a file with no values set

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [February 18, 2020, 2:57pm UTC](https://discuss.elastic.co/t/auditbeats-beats-file-permissions-for-file-output-not-working/219661/3 "2020-02-18T14:57:24Z")

</div>

`0600` is the default configuration for `permission`. So probably there is a problem in your configuration.

Could you please share it and format is using `</>`?

---

<div class="post-metadata">

**Author:** ![tomrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomrade/32/26626_2.png) [@tomrade](https://discuss.elastic.co/u/tomrade)\
**Post date:** [February 18, 2020, 3:21pm UTC](https://discuss.elastic.co/t/auditbeats-beats-file-permissions-for-file-output-not-working/219661/4 "2020-02-18T15:21:12Z")

</div>

I think ive figured it out '0600' works as does '0640', this is due the libbeats having a hardcoded umask of 0027 which means at most a file created can be '0640' nothing more.

> <https://github.com/elastic/beats/pull/14119>

I think i could recompile auditbeat to fix this, but for now I changed my systemd service to run in same group as my rsyslog user (syslog) and then set the value to "0640"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2020, 5:21pm UTC](https://discuss.elastic.co/t/auditbeats-beats-file-permissions-for-file-output-not-working/219661/5 "2020-03-17T17:21:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.