logrotate 切割文件报错 SELinux is preventing logrotate from ‘read, write’ accesses on the file

介绍


一般来说,日志是任何故障排除过程中非常重要的一部分,但这些日志会随着时间增长。在这种情况下,我们需要手动执行日志清理以回收空间,这是一件繁琐的管理任务。为了解决这个问题,我们可以在 Linux 中配置 logrotate 程序,它可以自动执行日志文件的轮换、压缩、删除和用邮件发出。我们可以配置 logrotate 程序,以便每个日志文件可以在每天、每周、每月或当它变得太大时处理。

logrotate配置


配置文件是对 /data/bpm/engine/logs/logs.txt 进行日志切割

/data/bpm/engine/logs/logs.txt {
    daily
    size 100M
    rotate 3
    missingok
    copytruncate
    create 644 root root
    dateext
    notifempty
    compress
}

报错日志


第二天早晨来了一看,日志并没有按时切割
报错内容
setroubleshoot: failed to retrieve rpm info for /data/bpm/engine/logs
setroubleshoot: SELinux is preventing /usr/sbin/logrotate from read access on the directory /data/bpm/engine/logs
SELinux is preventing /usr/sbin/logrotate from read access on the directory /data/bpm/engine/logs.#012#012*****

Sep 18 03:30:01 bpm1 systemd: Started Session 274416 of user root.
Sep 18 03:30:02 bpm1 dbus[4380]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Sep 18 03:30:02 bpm1 setroubleshoot: failed to retrieve rpm info for /data/bpm/engine/logs
Sep 18 03:30:02 bpm1 setroubleshoot: SELinux is preventing /usr/sbin/logrotate from read access on the directory /data/bpm/engine/logs. For complete SELinux messages run: sealert -l 22549acb-6393-4878-bf74-86df4389902e
Sep 18 03:30:02 bpm1 python: SELinux is preventing /usr/sbin/logrotate from read access on the directory /data/bpm/engine/logs.#012#012*****  Plugin restorecon (82.4 confidence) suggests   ************************#012#012If you want to fix the label. #012/data/bpm/engine/logs default label should be default_t.#012Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.#012Do#012# /sbin/restorecon -v /data/bpm/engine/logs#012#012*****  Plugin file (7.05 confidence) suggests   ******************************#012#012If you think this is caused by a badly mislabeled machine.#012Then you need to fully relabel.#012Do#012touch /.autorelabel; reboot#012#012*****  Plugin file (7.05 confidence) suggests   ******************************#012#012If you think this is caused by a badly mislabeled machine.#012Then you need to fully relabel.#012Do#012touch /.autorelabel; reboot#012#012*****  Plugin catchall_labels (4.59 confidence) suggests   *******************#012#012If you want to allow logrotate to have read access on the logs directory#012Then you need to change the label on /data/bpm/engine/logs#012Do#012# semanage fcontext -a -t FILE_TYPE '/data/bpm/engine/logs'#012where FILE_TYPE is one of the following: NetworkManager_log_t, NetworkManager_unit_file_t, NetworkManager_var_run_t, abrt_unit_file_t, abrt_var_cache_t, abrt_var_log_t, abrt_var_run_t, accountsd_unit_file_t, acct_data_t, admin_home_t, afs_logfile_t, aiccu_var_run_t, aide_log_t, ajaxterm_var_run_t, alsa_unit_file_t, alsa_var_run_t, amanda_log_t, amanda_unit_file_t, antivirus_log_t, antivirus_unit_file_t, antivirus_var_run_t, apcupsd_log_t, apcupsd_unit_file_t, apcupsd_var_run_t, apmd_log_t, apmd_unit_file_t, apmd_var_run_t, arpwatch_unit_file_t, arpwatch_var_run_t, asterisk_log_t, asterisk_var_run_t, audisp_var_run_t, auditd_unit_file_t, auditd_var_run_t, auth_cache_t, automount_unit_file_t, automount_var_run_t, avahi_unit_file_t, avahi_var_run_t, bacula_log_t, bacula_var_run_t, bcfg2_unit_file_t, bcfg2_var_run_t, bin_t, bitlbee_log_t, bitlbee_var_run_t, blkmapd_var_run_t, blktap_var_run_t, blueman_var_run_t, bluetooth_unit_file_t, bluetooth_var_run_t, boinc_log_t, boinc_unit_file_t, boot_t, bootloader_var_run_t, brltty_log_t, brltty_unit_file_t, brltty_var_run_t, bumblebee_unit_file_t, bumblebee_var_run_t, cachefilesd_var_run_t, calamaris_log_t, callweaver_log_t, callweaver_var_run_t, canna_log_t, canna_var_run_t, cardmgr_var_run_t, ccs_var_lib_t, ccs_var_log_t, ccs_var_run_t, cert_t, certmaster_var_log_t, certmaster_var_run_t, certmonger_unit_file_t, certmonger_var_run_t, cfengine_log_t, cgdcbxd_unit_file_t, cgdcbxd_var_run_t, cgred_log_t, cgred_var_run_t, cgroup_t, checkpc_log_t, chronyd_unit_file_t, chronyd_var_log_t, chronyd_var_run_t, cinder_api_unit_file_t, cinder_backup_unit_file_t, cinder_log_t, cinder_scheduler_unit_file_t, cinder_var_run_t, cinder_volume_unit_file_t, clogd_var_run_t, cloud_init_unit_file_t, cloud_log_t, cluster_unit_file_t, cluster_var_log_t, cluster_var_run_t, clvmd_var_run_t, cmirrord_var_run_t, cobbler_var_log_t, cockpit_unit_file_t, cockpit_var_run_t, collectd_unit_file_t, collectd_var_run_t, colord_unit_file_t, comsat_var_run_t, condor_log_t, condor_unit_file_t, condor_var_run_t, conman_log_t, conman_unit_file_t, conman_var_run_t, consolekit_log_t, consolekit_unit_file_t, consolekit_var_run_t, container_log_t, container_plugin_var_run_t, container_unit_file_t, container_var_run_t, couchdb_log_t, couchdb_unit_file_t, couchdb_var_run_t, courier_var_run_t, cpuplug_var_run_t, cpuspeed_var_run_t, cron_log_t, cron_var_run_t, crond_unit_file_t, crond_var_run_t, ctdbd_log_t, ctdbd_var_run_t, cupsd_config_var_run_t, cupsd_log_t, cupsd_lpd_var_run_t, cupsd_unit_file_t, cupsd_var_run_t, cvs_var_run_t, cyphesis_log_t, cyphesis_var_run_t, cyrus_var_run_t, dbskkd_var_run_t, dbusd_etc_t, dcc_var_run_t, dccd_var_run_t, dccifd_var_run_t, dccm_var_run_t, dcerpcd_var_run_t, ddclient_log_t, ddclient_var_run_t, deltacloudd_log_t, deltacloudd_var_run_t, denyhosts_var_log_t, device_t, devicekit_var_log_t, devicekit_var_run_t, dhcpc_var_run_t, dhcpd_unit_file_t, dhcpd_var_run_t, dictd_var_run_t, dirsrv_snmp_var_log_t, dirsrv_snmp_var_run_t, dirsrv_var_log_t, dirsrv_var_run_t, dirsrvadmin_unit_file_t, dkim_milter_data_t, dlm_controld_var_log_t, dlm_controld_var_run_t, dnsmasq_unit_file_t, dnsmasq_var_log_t, dnsmasq_var_run_t, dnssec_trigger_unit_file_t, dnssec_trigger_var_run_t, dovecot_var_log_t, dovecot_var_run_t, drbd_var_run_t, dspam_log_t, dspam_var_run_t, entropyd_var_run_t, etc_runtime_t, etc_t, eventlogd_var_run_t, evtchnd_var_log_t, evtchnd_var_run_t, exim_log_t, exim_var_run_t, fail2ban_log_t, fail2ban_var_run_t, faillog_t, fcoemon_var_run_t, fenced_var_log_t, fenced_var_run_t, fetchmail_log_t, fetchmail_var_run_t, file_context_t, fingerd_log_t, fingerd_var_run_t, firewalld_unit_file_t, firewalld_var_log_t, firewalld_var_run_t, foghorn_var_log_t, foghorn_var_run_t, fonts_cache_t, fonts_t, freeipmi_bmc_watchdog_unit_file_t, freeipmi_bmc_watchdog_var_run_t, freeipmi_ipmidetectd_unit_file_t, freeipmi_ipmidetectd_var_run_t, freeipmi_ipmiseld_unit_file_t, freeipmi_ipmiseld_var_run_t, fsadm_log_t, fsadm_var_run_t, fsdaemon_var_run_t, ftpd_unit_file_t, ftpd_var_run_t, games_srv_var_run_t, gdomap_var_run_t, getty_log_t, getty_unit_file_t, getty_var_run_t, gfs_controld_var_log_t, gfs_controld_var_run_t, glance_api_unit_file_t, glance_log_t, glance_registry_unit_file_t, glance_scrubber_unit_file_t, glance_var_run_t, glusterd_log_t, glusterd_var_run_t, gpm_var_run_t, gpsd_var_run_t, greylist_milter_data_t, groupd_var_log_t, groupd_var_run_t, gssproxy_unit_file_t, gssproxy_var_run_t, haproxy_unit_file_t, haproxy_var_log_t, haproxy_var_run_t, hsqldb_unit_file_t, httpd_config_t, httpd_log_t, httpd_sys_rw_content_t, httpd_unit_file_t, httpd_var_run_t, hwdata_t, hwloc_dhwd_unit_t, hwloc_var_run_t, hypervkvp_unit_file_t, hypervvssd_unit_file_t, icecast_log_t, icecast_var_run_t, ifconfig_var_run_t, inetd_child_var_run_t, inetd_log_t, inetd_var_run_t, init_var_run_t, initrc_var_log_t, initrc_var_run_t, innd_log_t, innd_unit_file_t, innd_var_run_t, insmod_var_run_t, iodined_unit_file_t, ipa_dnskey_unit_file_t, ipa_log_t, ipa_otpd_unit_file_t, ipa_var_run_t, ipmievd_unit_file_t, ipmievd_var_run_t, ipsec_log_t, ipsec_mgmt_unit_file_t, ipsec_mgmt_var_run_t, ipsec_var_run_t, iptables_unit_file_t, iptables_var_lib_t, iptables_var_run_t, irqbalance_var_run_t, iscsi_log_t, iscsi_unit_file_t, iscsi_var_run_t, isnsd_var_run_t, iwhd_log_t, iwhd_var_run_t, jetty_log_t, jetty_var_run_t, jockey_var_log_t, kadmind_log_t, kadmind_var_run_t, kdump_unit_file_t, keepalived_unit_file_t, keepalived_var_run_t, keystone_log_t, keystone_unit_file_t, keystone_var_run_t, kismet_log_t, kismet_var_run_t, klogd_var_run_t, kmscon_unit_file_t, krb5_conf_t, krb5kdc_log_t, krb5kdc_var_run_t, ksmtuned_log_t, ksmtuned_unit_file_t, ksmtuned_var_run_t, ktalkd_log_t, ktalkd_unit_file_t, l2tpd_var_run_t, lastlog_t, lib_t, lircd_var_run_t, lldpad_var_run_t, locale_t, locate_var_run_t, logrotate_tmp_t, logrotate_var_lib_t, logwatch_var_run_t, lpd_var_run_t, lsassd_var_run_t, lsmd_unit_file_t, lsmd_var_run_t, lttng_sessiond_unit_file_t, lttng_sessiond_var_run_t, lvm_unit_file_t, lvm_var_run_t, lwiod_var_run_t, lwregd_var_run_t, lwsmd_var_run_t, mailman_log_t, mailman_var_run_t, man_cache_t, man_t, mcelog_log_t, mcelog_var_run_t, mdadm_log_t, mdadm_unit_file_t, mdadm_var_run_t, memcached_var_run_t, minidlna_log_t, minidlna_var_run_t, minissdpd_var_run_t, mip6d_unit_file_t, mirrormanager_log_t, mirrormanager_var_run_t, mock_var_run_t, modemmanager_unit_file_t, mon_statd_var_run_t, mongod_log_t, mongod_unit_file_t, mongod_var_run_t, motion_log_t, motion_unit_file_t, motion_var_run_t, mount_var_run_t, mpd_log_t, mpd_var_run_t, mrtg_log_t, mrtg_var_run_t, mscan_var_run_t, munin_etc_t, munin_log_t, munin_var_run_t, mysqld_etc_t, mysqld_log_t, mysqld_unit_file_t, mysqld_var_run_t, mysqlmanagerd_var_run_t, mythtv_var_log_t, nagios_log
Sep 18 03:30:02 bpm1 setroubleshoot: failed to retrieve rpm info for /data/bpm/engine/logs/logs.txt
Sep 18 03:30:02 bpm1 setroubleshoot: SELinux is preventing logrotate from 'read, write' accesses on the file /data/bpm/engine/logs/logs.txt. For complete SELinux messages run: sealert -l 5fa91a89-8748-49ec-8a9a-d4f25d7c8078

Sep 18 03:30:02 bpm1 python: SELinux is preventing logrotate from 'read, write' accesses on the file /data/bpm/engine/logs/logs.txt.#012#012*****  Plugin restorecon (82.4 confidence) suggests   ************************#012#012If you want to fix the label. #012/data/bpm/engine/logs/logs.txt default label should be default_t.#012Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.#012Do#012# /sbin/restorecon -v /data/bpm/engine/logs/logs.txt#012#012*****  Plugin file (7.05 confidence) suggests   ******************************#012#012If you think this is caused by a badly mislabeled machine.#012Then you need to fully relabel.#012Do#012touch /.autorelabel; reboot#012#012*****  Plugin file (7.05 confidence) suggests   ******************************#012#012If you think this is caused by a badly mislabeled machine.#012Then you need to fully relabel.#012Do#012touch /.autorelabel; reboot#012#012*****  Plugin catchall_labels (4.59 confidence) suggests   *******************#012#012If you want to allow logrotate to have read write access on the logs.txt file#012Then you need to change the label on /data/bpm/engine/logs/logs.txt#012Do#012# semanage fcontext -a -t FILE_TYPE '/data/bpm/engine/logs/logs.txt'#012where FILE_TYPE is one of the following: NetworkManager_log_t, abrt_var_cache_t, abrt_var_log_t, acct_data_t, afs_cache_t, afs_logfile_t, aide_log_t, amanda_log_t, antivirus_log_t, apcupsd_log_t, apmd_log_t, asterisk_log_t, auth_cache_t, bacula_log_t, bitlbee_log_t, boinc_log_t, brltty_log_t, calamaris_log_t, callweaver_log_t, canna_log_t, ccs_var_lib_t, ccs_var_log_t, certmaster_var_log_t, cfengine_log_t, cgred_log_t, checkpc_log_t, chronyd_var_log_t, cinder_log_t, cloud_log_t, cluster_var_log_t, cobbler_var_log_t, condor_log_t, conman_log_t, consolekit_log_t, container_log_t, couchdb_log_t, cron_log_t, ctdbd_log_t, cupsd_log_t, cyphesis_log_t, ddclient_log_t, deltacloudd_log_t, denyhosts_var_log_t, devicekit_var_log_t, dirsrv_snmp_var_log_t, dirsrv_var_log_t, dlm_controld_var_log_t, dnsmasq_var_log_t, dovecot_var_log_t, dspam_log_t, evtchnd_var_log_t, exim_log_t, fail2ban_log_t, faillog_t, fenced_var_log_t, fetchmail_log_t, fingerd_log_t, firewalld_var_log_t, foghorn_var_log_t, fsadm_log_t, getty_log_t, gfs_controld_var_log_t, glance_log_t, glusterd_log_t, groupd_var_log_t, haproxy_var_log_t, httpd_log_t, icecast_log_t, inetd_log_t, initrc_var_log_t, innd_log_t, ipa_log_t, ipsec_log_t, iscsi_log_t, iwhd_log_t, jetty_log_t, jockey_var_log_t, kadmind_log_t, keystone_log_t, kismet_log_t, krb5kdc_log_t, ksmtuned_log_t, ktalkd_log_t, lastlog_t, logrotate_lock_t, logrotate_tmp_t, logrotate_var_lib_t, mailman_log_t, mcelog_log_t, mdadm_log_t, minidlna_log_t, mirrormanager_log_t, mongod_log_t, motion_log_t, mpd_log_t, mrtg_log_t, munin_log_t, mysqld_log_t, mythtv_var_log_t, nagios_log_t, named_cache_t, named_log_t, neutron_log_t, nova_log_t, nscd_log_t, nsd_log_t, ntpd_log_t, numad_var_log_t, openhpid_log_t, openshift_log_t, openshift_var_lib_t, opensm_log_t, openvpn_status_t, openvpn_var_log_t, openvswitch_log_t, openwsman_log_t, osad_log_t, passenger_log_t, pcp_log_t, piranha_log_t, pkcs_slotd_log_t, pki_log_t, pki_ra_log_t, pki_tomcat_log_t, pki_tps_log_t, plymouthd_var_log_t, polipo_log_t, postgresql_log_t, pppd_log_t, pptp_log_t, prelink_log_t, prelude_log_t, privoxy_log_t, procmail_log_t, prosody_log_t, psad_var_log_t, puppet_log_t, puppet_tmp_t, pyicqt_log_t, qdiskd_var_log_t, rabbitmq_var_log_t, radiusd_log_t, redis_log_t, rhev_agentd_log_t, rhsmcertd_log_t, ricci_modcluster_var_log_t, ricci_var_log_t, rpm_log_t, rsync_log_t, rtas_errd_log_t, samba_log_t, sanlock_log_t, sectool_var_log_t, sendmail_log_t, sensord_log_t, setroubleshoot_var_log_t, shorewall_log_t, slapd_log_t, slpd_log_t, smsd_log_t, snapperd_log_t, snmpd_log_t, snort_log_t, spamd_log_t, speech-dispatcher_log_t, squid_log_t, sssd_var_log_t, stapserver_log_t, stunnel_log_t, sudo_log_t, svnserve_log_t, sysstat_log_t, systemd_passwd_var_run_t, thin_aeolus_configserver_log_t, thin_log_t, tomcat_log_t, tor_var_log_t, tuned_log_t, ulogd_var_log_t, uucpd_log_t, var_log_t, var_spool_t, varnishlog_log_t, vdagent_log_t, virt_cache_t, virt_log_t, virt_qemu_ga_log_t, vmware_log_t, watchdog_log_t, winbind_log_t, wtmp_t, xdm_log_t, xend_var_log_t, xenstored_var_log_t, xferlog_t, xserver_log_t, zabbix_log_t, zarafa_deliver_log_t, zarafa_gateway_log_t, zarafa_ical_log_t, zarafa_indexer_log_t, zarafa_monitor_log_t, zarafa_server_log_t, zarafa_spooler_log_t, zebra_log_t, zoneminder_log_t.#012Then execute:#012restorecon -v '/data/bpm/engine/logs/logs.txt'#012#012#012*****  Plugin catchall (1.31 confidence) suggests   **************************#012#012If you believe that logrotate should be allowed read write access on the logs.txt file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'logrotate' --raw | audit2allow -M my-logrotate#012# semodule -i my-logrotate.pp#012
Sep 18 03:31:01 bpm1 systemd: Started Session 274417 of user root.
Sep 18 03:32:01 bpm1 systemd: Started Session 274418 of user root.
Sep 18 03:33:01 bpm1 systemd: Started Session 274419 of user root.
Sep 18 03:34:01 bpm1 systemd: Started Session 274420 of user root.
Sep 18 03:35:01 bpm1 systemd: Started Session 274421 of user root.
Sep 18 03:36:01 bpm1 systemd: Started Session 274422 of user root.
Sep 18 03:37:01 bpm1 systemd: Started Session 274423 of user root.
Sep 18 03:38:01 bpm1 systemd: Started Session 274424 of user root.

分析报错内容是selinux


查看selinux状态,发现selinux是开开启的

[root@code404.icu ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31

调整selinux配置


把selinux 调整为 permissive
临时修改

setenforce 0

永久修改

vim /etc/selinux/config
SELINUX=permissive

查看当前状态

[root@code404.icu ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31

此时,可以调整crontab 让logrotate 触发,就正常切割了

版权声明:本文为作者原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接和本声明。

原创文章,作者:老C,如若转载,请注明出处:https://www.code404.icu/1217.html

发表评论

登录后才能评论