# Permission denied /usr/share/logstash/run

**URL:** <https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769>\
**Category:** Logstash\
**Created:** [March 15, 2023, 4:13pm UTC](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769 "2023-03-15T16:13:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RJC](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@RJC](https://discuss.elastic.co/u/RJC)\
**Post date:** [March 15, 2023, 4:13pm UTC](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769/1 "2023-03-15T16:13:41Z")

</div>

I am getting the following error message when starting Logstash on a Linux server:

[ERROR][logstash.java.pipeline][main] Pipeline worker error, the pipeline will be stopped (:pipeline\_id=\>"main", :error=\>" (EACCESS) Permission denied - /usr/share/logstash/run".

I looked into /usr/share/logstash directory, but it does not contain "run" subdirectory.

I tried to Google for this error, but did not find anything applicable. Any suggestions how to fix this problem?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [March 16, 2023, 8:56am UTC](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769/2 "2023-03-16T08:56:24Z")

</div>

Check permission on data and log directories. [Here](https://www.elastic.co/guide/en/logstash/current/dir-layout.html) are locations.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 19, 2023, 9:03pm UTC](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769/3 "2023-03-19T21:03:00Z")

</div>

Welcome to our community! 😃

How did you install Logstash exactly, deb/rpm, tar.gz?

---

<div class="post-metadata">

**Author:** ![RJC](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@RJC](https://discuss.elastic.co/u/RJC)\
**Post date:** [March 23, 2023, 7:29pm UTC](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769/4 "2023-03-23T19:29:51Z")

</div>

Sorry for delay in responding, but I was able to identify the root cause and fix the problem. It turned out to be trivial!

The problem was that the person who created the output config file for Logstash to write syslog messages to hard drive, wrote the path for the directory where the messages were to be written without the initial forward slash, thus making the path relative, instead of absolute. This caused Logstash to attempt to write files to a non existing directory (using /usr/share/logstash as starting point, which was not as intended) which of course resulted in the access permission error.

Once I converted the paths to absolute and restarted logstash the problem disappeared.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2023, 7:30pm UTC](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769/5 "2023-04-20T19:30:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.