input file, sincedb_path no happy with the previous config
Logstash changes the permissions of the directory, and cannot then read the files.
This is what I get after a restart on 1.5.0
[elk@elksyd001 logstash-1.5.0]$ ls -la ~/ELK/workingDirs/sinceDbPath/
ls: cannot access /home/elk/ELK/workingDirs/sinceDbPath/.: Permission denied
ls: cannot access /home/elk/ELK/workingDirs/sinceDbPath/..: Permission denied
ls: cannot access /home/elk/ELK/workingDirs/sinceDbPath/.9788.19643.37069: Permission denied
ls: cannot access /home/elk/ELK/workingDirs/sinceDbPath/.9788.20274.996751: Permission denied
ls: cannot access /home/elk/ELK/workingDirs/sinceDbPath/.9788.24645.607070: Permission denied
ls: cannot access /home/elk/ELK/workingDirs/sinceDbPath/.9788.25830.88992: Permission denied
total 0
d????????? ? ? ? ? ? .
d????????? ? ? ? ? ? ..
?????????? ? ? ? ? ? .9788.19643.37069
?????????? ? ? ? ? ? .9788.20274.996751
?????????? ? ? ? ? ? .9788.24645.607070
?????????? ? ? ? ? ? .9788.25830.88992
[elk@elksyd001 config]$ ls -dl ~/ELK/workingDirs/sinceDbPath
drw-rw-rw-. 2 elk elk 104 May 27 12:34 /home/elk/ELK/workingDirs/sinceDbPath
[elk@elksyd001 config]$ ls -dl ~/ELK/workingDirs
drwxrwxr-x. 3 elk elk 24 May 27 12:27 /home/elk/ELK/workingDirs
[elk@elksyd001 logstash-1.5.0]$ id
uid=1005(elk) gid=1005(elk) groups=1005(elk) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
The error from logstash is :
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::File path=>["/var/log/messages"], sincedb_path=>"/home/elk/ELK/workingDirs/sinceDbPath/", type=>"syslog", start_position=>"end", delimiter=>"\n">
Error: Permission denied - /home/elk/ELK/workingDirs/sinceDbPath/.9788.24645.607070 or /home/elk/ELK/workingDirs/sinceDbPath/ {:level=>:error}
Errno::EACCES: Permission denied - /home/elk/ELK/workingDirs/sinceDbPath/.9788.24645.524011
initialize at org/jruby/RubyFile.java:362
new at org/jruby/RubyIO.java:851
atomic_write at /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/filewatch-0.6.2/lib/filewatch/helper.rb:33
_sincedb_write at /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/filewatch-0.6.2/lib/filewatch/tail.rb:233
sincedb_write at /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/filewatch-0.6.2/lib/filewatch/tail.rb:203
teardown at /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/logstash-input-file-0.1.10/lib/logstash/inputs/file.rb:151
inputworker at /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/pipeline.rb:203
synchronize at org/jruby/ext/thread/Mutex.java:149
inputworker at /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/pipeline.rb:203
start_input at /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/pipeline.rb:171
before the restart, the ~/ELK/workingDirs/sinceDbPath directory has the 776 permissions.
drwxrwxr-x. 3 elk elk 24 May 27 12:27 /home/elk/ELK/workingDirs/sinceDbPath
config is
input {
file {
path => "/localDisk1/flume/*mymymy*log"
type => "mytest"
sincedb_path => "/home/elk/ELK_temp/workingDirs/sinceDbPath/"
}