Why logstash.err and logstash.stdout are created with root privileges?

Elastic Stack Logstash
1

Hi,

I am new logstash, i've installed logstash-2.2.4 on centos linux and placed my config file at /etc/logstash/conf.d folder and try to start logstash using "service logstash start" command as a root user. By default logstash service getting started as "logstash" user and created following log files at /var/log/logstash.

/var/log/logstash # ls -ltr
total 8
-rw-r--r-- 1 root root 0 Sep 1 12:02 logstash.err
-rw-r--r-- 1 root root 57 Sep 1 12:02 logstash.stdout
-rw-r--r-- 1 logstash logstash 186 Sep 1 12:02 logstash.log

Couple of queries:

  1. why "logstash.err" and "logstash.stdout" log files are created with "root" user priviledges and only logstash.log file getting created as "logstash" user permission?
  2. Is there any log/error message will be written to "logstash.err" and "logstash.stdout" once the service is up? seems other than the root...no one have write permission! Just need some understanding/purpose behind these two files.
  3. i just installed java, didn't set any JAVA_HOME or PATH env variables, but logstash picks the java path from /usr/bin/java when it starts ( logstash 23686 1 99 13:19 pts/1 00:00:03 /usr/bin/java).
    i see logstash script is placed at /etc/init.d/logstash and having following entries. How does this works?
    LS_JAVA_OPTS="${LS_JAVA_OPTS} -Djava.io.tmpdir=${LS_HOME}"
    HOME=${LS_HOME}
    export PATH HOME LS_HEAP_SIZE LS_JAVA_OPTS LS_USE_GC_LOGGING LS_GC_LOG_FILE

Thanks,
Saravanan

2

why "logstash.err" and "logstash.stdout" log files are created with "root" user priviledges and only logstash.log file getting created as "logstash" user permission?

Because logstash.log is created once Logstash has started (as the logstash user) while the other files are created by a root shell before Logstash starts and before its privileges have been dropped.

Is there any log/error message will be written to "logstash.err" and "logstash.stdout" once the service is up? seems other than the root...no one have write permission! Just need some understanding/purpose behind these two files.

The Logstash process's stdout and stderr streams are already connected to those files when Logstash starts so permissions are not a problem. However, Logstash wouldn't be able to open those files again because it, as you're saying, doesn't have sufficient permissions.

i just installed java, didn't set any JAVA_HOME or PATH env variables, but logstash picks the java path from /usr/bin/java when it starts ( logstash 23686 1 99 13:19 pts/1 00:00:03 /usr/bin/java).
i see logstash script is placed at /etc/init.d/logstash and having following entries. How does this works

/usr/bin is in the PATH by default so Logstash will pick it up automatically.

1 Like
3

Thanks much for the clarifications :slight_smile: