Collect Unix Log Files Using Cribl Edge and a File Monitor Source with ACLS

Objective

Configure Linux file and directory ACLs so Cribl Edge File Monitor can read the required log files on Red Hat Linux servers, including /var/log/messages and /var/log/audit/audit.log, and continue collecting audit.log after log rotation.

Environment

• Product: Cribl Edge
• Version: 4.16.1
• Source type: File Monitor
• Operating system: Linux Red Hat servers
• Typical symptom: the desired logs are not being collected because file permissions or ACLs prevent the cribl user from reading them.

Procedure

1. Review the current ACLs on the affected files and directories to confirm whether the cribl user can read them. Example:
   getfacl /var/log/audit/audit.log
2. Check whether the ACL mask is blocking access. If the file shows mask::---, the effective permissions for the cribl user are blocked even if a user ACL entry exists.
3. Reset or remove incorrect ACLs on the affected log paths before reapplying the required permissions.
4. Apply default ACLs recursively on /var/log so newly created files and directories inherit read and execute access for the cribl user. setfacl -Rdm -u:cribl:r-x /var/log
5. Grant read access to the current /var/log/messages file.
   setfacl -m u:cribl:r-- /var/log/messages
6. Grant read access to the current /var/log/audit/audit.log file.
   setfacl -m u:cribl:r-- /var/log/audit/audit.log
7. Create a script to reapply the ACL on audit.log after rotation, because the case showed that auditd/log rotation can overwrite the ACLs on that file.

   Create /usr/local/bin/fix_audit_acl.sh with the correct owner and mode, and add this to the file:

   setfacl -m u:cribl:r-- /var/log/audit/audit.log
8. Schedule the script in root’s crontab to run every minute so the ACL is restored quickly after rotation.
   * * * * * /usr/local/bin/fix_audit_acl.sh
9. Configure File Monitor sources to target the required files only.
   • Create an auditlog source:
     • Search path: /var/log/audit
     • Max depth: 1
     • Allow list: /var/log/audit/audit.log
   • Create a varlog source:
     • Search path: /var/log
     • Max depth: 1
     • Allow list includes:
       • /var/log/messages*
       • /var/log/secure*
       • /var/log/audit/audit.log
       • /var/log/cron*
       • /var/log/journal*
       • /var/log/yum.log
       • /var/log/dnf.log
10. Validate collection after the next log rotation to confirm that both the ACLs and File Monitor configuration persist as expected.

Last Validated

• Cribl Edge 4.16.1

Additional Information

• In this example, audit.log stopped being collected after rotation because the ACL mask became mask::---, which blocked the effective access for the cribl user.
• Using setfacl -m u:cribl:r /var/log/audit/* only sets read on existing files and does not address the need for inherited access on new files and directories.
• If log rotation uses methods such as copytruncate or recreates the file without preserving ACLs, default ACLs alone may not be sufficient; reapplying the ACL with a scheduled script can prevent collection gaps.