FS#61176 - [filebeat] default configuration not running - wrong user/group settings

Attached to Project: Community Packages
Opened by Thomas Jäger (xunil64) - Wednesday, 26 December 2018, 12:17 GMT
Last edited by Massimiliano Torromeo (mtorromeo) - Monday, 03 June 2019, 08:37 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Massimiliano Torromeo (mtorromeo)
Levente Polyak (anthraxx)
Architecture x86_64
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

Filebeat is not running with the default configuration.
* open /var/lib/filebeat/registry: permission denied
* failed to rotate backups: failed to rotate backups: rename /var/log/filebeat/filebeat.4 /var/log/filebeat/filebeat.5: permission denied
* ...

/usr/lib/systemd/system/filebeat.service is running with user filebeat,
but the default configs/path are created with root:root
- /var/log/filebeat
- /var/lib/filebeat
- /usr/share/filebeat

Additional info:
* version: filebeat-6.5.4-1 (but was wrong with prior versions too)

Steps to reproduce:
* pacman -S filebeat
* <edit> /etc/filebeat/filebeat.yml
* systemctl start filebeat.service
This task depends upon

Closed by  Massimiliano Torromeo (mtorromeo)
Monday, 03 June 2019, 08:37 GMT
Reason for closing:  Fixed
Additional comments about closing:  filebeat-7.1.1-1
Comment by Phlogi (Phlogiston) - Thursday, 28 February 2019, 10:03 GMT
I can confirm this issue with filebeat 6.6.0-1. The following commands with the startup of the filebeat daemon:
chown -R filebeat:filebeat /var/lib/filebeat/
chown -R filebeat:filebeat /var/log/filebeat

But then, you also need to make sure that the filebeat user can read your logs. E.g. this could help for nginx logs:
usermod -aG log filebeat
Comment by Massimiliano Torromeo (mtorromeo) - Monday, 03 June 2019, 08:37 GMT
I removed the filebeat user from the default configuration. This is the same as upstream and all the other beats packages.

If you need to use a different user you can drop a file in /etc/systemd/system/filebeat.service.d/user.conf with:

[Service]
User=myuser

Loading...