This message originated from Cribl Community Slack.
Click here to view the original link.
Hello all,
I'm trying to configure File monitor on a fleet of Ubuntu host. The error I'm getting s EACCES: permission denied, watch '/var/log/whatever.log'
Would the fix just be granting the Cribl user permissions over that folder?
Since I don't have access to those folders, I want to see if someone has a known solution to this, can't test it out since I don't have access to the host and want to minimize effort for the team managing those host.
Solved
File Monitor Configuration Failing With: EACCES Permission Denied Error
Best answer by Jon Rust
Specifically, the team should
- edit systemd:
systemctl edit cribl-edge - paste in the following
[Service]
AmbientCapabilities=CAP_DAC_READ_SEARCH- restart cribl:
systemctl restart cribl-edge
You want the CAP_DAC_READ_SEARCH capability
Specifically, the team should
- edit systemd:
systemctl edit cribl-edge - paste in the following
[Service]
AmbientCapabilities=CAP_DAC_READ_SEARCH- restart cribl:
systemctl restart cribl-edge
Hey @user, found a server to test on and it appears to be working after updating the conf file and restarting cribl.
Thanks for the help.
Sign up
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.