rsyslog - ID for group 'special' could not be found [try http://www.rsyslog.com/e/3003]
Issue
rsyslog is writing logs, but is not preserving the group and mode it is configured to use.
Incorrect permissions on badserver:
badserver$ ls -l /logs/badserver
drwxr-x--- 2 root root 4096 Apr 24 09:53 2015.03.23
drwxr-x--- 2 root root 4096 Apr 24 02:22 2015.03.24
Versus correct permissions seen here on goodserver:
goodserver$ ls -l /logs/goodserver
drwxr-s--- 2 root special 4096 Apr 23 18:01 2015.03.23
drwxr-s--- 2 root special 4096 Apr 24 04:01 2015.03.24
Checking /var/log/messages, the following logging is seen:
badserver$ cat /var/log/message* | grep rsyslogd
Mar 21 09:04:17 badserver rsyslogd-3003: ID for group 'special' could not be found [try http://www.rsyslog.com/e/3003 ]
Mar 21 09:04:17 badserver rsyslogd: the last error occured in /etc/rsyslog.d/custom.conf, line 9:"$DirGroup special"
Mar 21 09:04:17 badserver rsyslogd-3003: ID for group 'special' could not be found [try http://www.rsyslog.com/e/3003 ]
Mar 21 09:04:17 badserver rsyslogd: the last error occured in /etc/rsyslog.d/custom.conf, line 10:"$FileGroup special"
Mar 21 09:04:17 badserver rsyslogd: the last error occured in /etc/rsyslog.conf, line 31:"$IncludeConfig /etc/rsyslog.d/*.conf"
Mar 21 09:04:17 badserver rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]
Environment
- Red Hat Enterprise Linux 6
- FoxT BoKS ServerControl product
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.