Logstash fails to open file: Permission denied

Elastic Stack Logstash
1

Hi everybody,

I'm currently encountering the error that Logstash is not able to open several files due to a "Permission denied" error

[2017-08-24T08:25:43,619][WARN ][logstash.inputs.file     ] failed to open /media/Logs/000000760400001.txt: Permission denied - /media/Logs/000000760400001.txt

The files have the following access rights:
-rwxr-xr-x 1 elk elk 1348 Aug 17 09:02 000000760400001.txt
I'm running Logstash as the user elk (who is a member of the adm group) so the privileges should be sufficient. I also ran Logstash as a superuser with the same result. I'm running Logstash by executing elk@ELK:~$ /media/ELKstack/logstash-5.5.1/bin/logstash as I downloaded the zip files instead of installing from DEB.
Has anybody an idea of the cause of this error? Interestingly, this does not apply to all files as some are processed.

Best regards,

Hisushi

2

Please show the output of ls -ld /media /media/Logs.

3

It's
drwxr-xr-x 9 root root 4096 Aug 11 14:04 /media
drwxr-xr-x 12 elk elk 4096 Aug 16 16:22 /media/Logs

4

Hmm, that looks okay. I wonder if a directory ACL or SELinux or something is blocking the access.

5

is it CentOS 7?
In case selinux is enabled please do below
$ sestatus
if you see its enabled then
$ vi /etc/sysconfig/selinux
find selinux=enforcing and change it to selinux=disabled press :wq to save and quit from the editor.
Reboot the server you should be fine now

6

AFAIK no ACL is applied. And it's a Ubuntu 16.04 machine. Is it possible that it has to to with this "Too many files" error that has been mentioned in different topics?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.