rsyslog - ID for group 'special' could not be found [try http://www.rsyslog.com/e/3003]

Solution Verified - Updated -

Issue

rsyslog is writing logs, but is not preserving the group and mode it is configured to use.

Incorrect permissions on badserver:

badserver$ ls -l /logs/badserver
drwxr-x--- 2 root root 4096 Apr 24 09:53 2015.03.23
drwxr-x--- 2 root root 4096 Apr 24 02:22 2015.03.24

Versus correct permissions seen here on goodserver:

goodserver$ ls -l /logs/goodserver
drwxr-s--- 2 root special 4096 Apr 23 18:01 2015.03.23
drwxr-s--- 2 root special 4096 Apr 24 04:01 2015.03.24

Checking /var/log/messages, the following logging is seen:

badserver$ cat /var/log/message* | grep rsyslogd
Mar 21 09:04:17 badserver rsyslogd-3003: ID for group 'special' could not be found [try http://www.rsyslog.com/e/3003 ]
Mar 21 09:04:17 badserver rsyslogd: the last error occured in /etc/rsyslog.d/custom.conf, line 9:"$DirGroup special"
Mar 21 09:04:17 badserver rsyslogd-3003: ID for group 'special' could not be found [try http://www.rsyslog.com/e/3003 ]
Mar 21 09:04:17 badserver rsyslogd: the last error occured in /etc/rsyslog.d/custom.conf, line 10:"$FileGroup special"
Mar 21 09:04:17 badserver rsyslogd: the last error occured in /etc/rsyslog.conf, line 31:"$IncludeConfig /etc/rsyslog.d/*.conf"
Mar 21 09:04:17 badserver rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]

Environment

  • Red Hat Enterprise Linux 6
  • FoxT BoKS ServerControl product

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content