Not processing input/output unless running as root

[gregorys (Gregory)]

Hi,

OS: Debian 10.3

openjdk version "11.0.7" 2020-04-14
OpenJDK Runtime Environment (build 11.0.7+10-post-Debian-3deb10u1)
OpenJDK 64-Bit Server VM (build 11.0.7+10-post-Debian-3deb10u1, mixed mode, sharing)

Logstash 6.8.8

I have a simple configuration with an input (file) and an output (file).
When running under the logstash user, it doesn't seem to process anything, but I don't see any errors when setting the log level to debug or trace.

When running logstash as root, everything works fine.

[ptamba]

have you tried running logstash from CLI to see what could be the problem? The only idea that i can think of is that your input is trying to use resources that is only writable / accessible by root. This could be registry path for input, or permission of the input, or permission to write the output

[gregorys (Gregory)]

Indeed it's the input file that is not readable by the logstash user.
I would have expected this to appear in the logs when I run logstash with loglevel debug/trace or from CLI, but couldn't find any error or notification on that.

Thanks

[abrx]

Hi,
Be careful, it sometime happens also when the file is readable by logstash BUT under a root:root folder which logstash cannot cross and even spot.
You can see if logstash started watching a file with the presence / absence of a sincedb file that tracks logstash reading position.