# Filebeat unable to access logs under “/var/lib/docker/containers” path due to "Permission Denied" issue

**URL:** <https://discuss.elastic.co/t/filebeat-unable-to-access-logs-under-var-lib-docker-containers-path-due-to-permission-denied-issue/234696>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 28, 2020, 9:04am UTC](https://discuss.elastic.co/t/filebeat-unable-to-access-logs-under-var-lib-docker-containers-path-due-to-permission-denied-issue/234696 "2020-05-28T09:04:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhavaniprasad\_reddy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavaniprasad_reddy/32/52086_2.png) [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\
**Post date:** [May 28, 2020, 9:04am UTC](https://discuss.elastic.co/t/filebeat-unable-to-access-logs-under-var-lib-docker-containers-path-due-to-permission-denied-issue/234696/1 "2020-05-28T09:04:45Z")

</div>

I am trying to deploy ELK stack with Filebeat in Openshift environment.

Filebeat is trying to read the log files under "/var/lib/docker/containers" path of a pod but it failed with "Permission Denied" error.

I am using an SCC with "runsAsAny" and "runAsUser: 0",

```
- apiVersion: v1
  kind: SecurityContextConstraints
  metadata:
    name: hostpath
  allowPrivilegedContainer: true
  allowHostDirVolumePlugin: true
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  fsGroup:
    type: RunAsAny
  readOnlyRootFilesystem: false
  supplementalGroups:
    type: RunAsAny
  users:
  - my-admin-user
  groups:
  - my-admin-group

```

Volume Mounts:

```
volumeMounts:
- mountPath: /var/lib/docker/containers
  name: varlibdockercontainers

```

HostPath Volume:

```
securityContext:
  runAsUser: 0
volumes:
- hostPath:
    path: /var/lib/docker/containers
    type: ""
  name: varlibdockercontainers

```

Please let me know if I am missing something in SCC to have atleast read permissions in "/var/lib/docker/containers" path.

ELK stack versions:

```auto
FIlebeat - 6.4.1
Logstash - 6.3.1
elastic - 6.5.4 &
kibana - 6.5.4

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2020, 9:10am UTC](https://discuss.elastic.co/t/filebeat-unable-to-access-logs-under-var-lib-docker-containers-path-due-to-permission-denied-issue/234696/2 "2020-06-25T09:10:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.