# Kibana container: permission denied error related to /var/log/kibana.log

**URL:** <https://discuss.elastic.co/t/kibana-container-permission-denied-error-related-to-var-log-kibana-log/363086>\
**Category:** Kibana\
**Tags:** docker\
**Created:** [July 14, 2024, 12:01am UTC](https://discuss.elastic.co/t/kibana-container-permission-denied-error-related-to-var-log-kibana-log/363086 "2024-07-14T00:01:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dan567](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@Dan567](https://discuss.elastic.co/u/Dan567)\
**Post date:** [July 14, 2024, 12:01am UTC](https://discuss.elastic.co/t/kibana-container-permission-denied-error-related-to-var-log-kibana-log/363086/1 "2024-07-14T00:01:55Z")

</div>

Hello community,

running Kibana v8.14.1 in its own Docker container.

**Issue:**  
configuring Kibana to write its log file to /var/log/kibana.log, following the guidance in the Kibana logging settings documentation:

> **[Logging settings in Kibana | Kibana Guide \[8.14\] | Elastic](https://www.elastic.co/guide/en/kibana/current/logging-settings.html)**

I encounter an EACCES: permission denied error related to /var/log/kibana.log.

This is because the /var/log directory inside the Kibana container is owned by root:root, and Kibana, running as a non-root user inside the container, does not have permission to write to it.

**Does anyone encounter similar issue and how to fix it, thanks**

\*\*\*\ ***error:**

Container elastic-stack-13jul-kibana-1 Error

$ sudo docker logs -f 5601f4e7f681  
[Error: EACCES: permission denied, open '/var/log/kibana.log'] {  
errno: -13,  
code: 'EACCES',  
syscall: 'open',  
path: '/var/log/kibana.log'  
}

**docker compose and yml files**

```auto

---docker-compose.yml---

...

kibana:
    depends_on:
      elasticsearch01:
        condition: service_healthy
    image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
   # user: --allow-root
    labels:
      co.elastic.logs/module: kibana
    volumes:
      - certs:/usr/share/kibana/config/certs
      - kibanadata:/usr/share/kibana/data
      - "./kibana.yml:/usr/share/kibana/config/kibana.yml"
    
    ports:
      - ${KIBANA_PORT}:5601
    environment:
      - SERVERNAME=kibana
      - ELASTICSEARCH_HOSTS=https://elasticsearch01:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
      - XPACK_SECURITY_ENCRYPTIONKEY=${ENCRYPTION_KEY}
      - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=${ENCRYPTION_KEY}
      - XPACK_REPORTING_ENCRYPTIONKEY=${ENCRYPTION_KEY}
...

```

```auto
---$ cat kibana.yml---
logging:
  appenders:
    file:
      type: file
      fileName: /var/log/kibana.log
      layout:
        type: pattern
  root:
    appenders: [file]

```

---

<div class="post-metadata">

**Author:** ![Dan567](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@Dan567](https://discuss.elastic.co/u/Dan567)\
**Post date:** [July 14, 2024, 5:06pm UTC](https://discuss.elastic.co/t/kibana-container-permission-denied-error-related-to-var-log-kibana-log/363086/2 "2024-07-14T17:06:01Z")

</div>

I figured it out! I updated the YAML file and pointed kibana.log to the directory /usr/share/kibana/logs, to which user 'kibana' has full access, and it works for me now.

there's a logs directory under /usr/share/kibana and owner is kibana:

```auto
XXX@XXX:~/elastic-stack-13Jul$ sudo docker exec -it 6f7b907ea419 /bin/sh
$ pwd
/usr/share/kibana
$ ls -al
total 1832

```

...  
drwxrwxr-x 1 kibana root 24 Jul 14 16:14 logs  
...

**Updated kibana.yml and point log file to this directory:**

```auto
logging:

logging:
  appenders:
    file:
      type: file
      fileName: /usr/share/kibana/logs/kibana.log
      layout:
        type: pattern
  root:
    appenders: [file]
# New server settings
server:
  host: "0.0.0.0"
  shutdownTimeout: "5s"
# Existing Elasticsearch connection 
elasticsearch.hosts: ["http://elasticsearch:9200"]

```

"docker compose up" and Now the logs appear in the Kibana container:

> -rw-rw-r-- 1 kibana kibana 20001 Jul 14 16:14 kibana.log

**$ cat kibana.log**

> [2024-07-14T16:14:19.830+00:00][INFO][root] Kibana is starting  
> [2024-07-14T16:14:19.901+00:00][INFO][node] Kibana process configured with roles: [background\_tasks, ui]  
> [2024-07-14T16:14:27.714+00:00][INFO][plugins-service] The following plugins ar