Error "failed to open config file syslog: Permission denied" in logrotate.service

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

On a VMware Telco Cloud Automation (TCA) node, the logrotate.service systemd unit fails to start and enters a failed state:

logrotate.service - Rotate log files
Loaded: loaded (/usr/lib/systemd/system/logrotate.service; static)
Active: failed (Result: exit-code)
TriggeredBy: logrotate.timer
Process: ExecStart=/usr/sbin/logrotate /etc/logrotate.conf (code=exited, status=1/FAILURE)

Running logrotate --debug /etc/logrotate.conf outputs one or more of the following errors:

error: failed to open config file syslog: Permission denied
error: found error in file syslog, skipping
error: skipping "/var/log/vmware/capengine/core-engine.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root")
error: skipping "/var/log/vmware/capengine/workflow-manager-http.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root")
error: skipping "/var/log/vmware/messages" because parent directory has insecure permissions (It's world writable or writable by group which is not "root")

 

 

Environment

TCA 3.4

TCP 5.1.x

Cause

Deployment misconfigurations set permissions on /etc/logrotate.d/syslog to 600 instead of 644 (blocking logrotate read access) and set /var/log/vmware/ directory permissions to world-writable 0707 instead of 0755 (triggering logrotate security checks).

 

Resolution

Perform the following steps on each affected TCA node as root:

1. Confirm the issue permissions:

   ls -la /etc/logrotate.d/syslog stat /var/log/vmware | grep -E "File:|Access:"

   Expected broken state: 600 permissions on syslog and 0707 (drwx---rwx) on the vmware directory.
   
   

2. Fix the syslog configuration file permissions:
   

   chmod 644 /etc/logrotate.d/syslog

    

3. Determine whether /var/log/vmware is a directory or a symbolic link:
   

   stat /var/log/vmware

    

4.  Fix log directory permissions based on step 3 output:
   
   
   1. If /var/log/vmware is a real directory:
      

      chmod 755 /var/log/vmware/ /var/log/vmware/capengine/ /var/log/vmware/agent/ /var/log/vmware/tca/

       

   2. If /var/log/vmware is a symbolic link pointing to /logs/vmware:

      chmod 755 /logs/vmware/ /logs/vmware/capengine/ /logs/vmware/agent/ /logs/vmware/tca/

       

5.  (Optional) Make permission fixes persistent across reboots:
   
   
   1. If /var/log/vmware is a real directory:
      

      cat > /etc/tmpfiles.d/vmware-logdir.conf << 'EOF'
      d /var/log/vmware 0755 root root -
      d /var/log/vmware/capengine 0755 root root -
      d /var/log/vmware/agent 0755 root root -
      d /var/log/vmware/tca 0755 root root -
      EOF
      systemd-tmpfiles --create /etc/tmpfiles.d/vmware-logdir.conf

       

   2. If /var/log/vmware is a symbolic link to /logs/vmware:
      

      cat > /etc/tmpfiles.d/vmware-logdir.conf << 'EOF'
      d /logs/vmware 0755 root root -
      d /logs/vmware/capengine 0755 root root -
      d /logs/vmware/agent 0755 root root -
      d /logs/vmware/tca 0755 root root -
      EOF
      systemd-tmpfiles --create /etc/tmpfiles.d/vmware-logdir.conf

      
      Verify rule creation:

      echo $?
      stat /var/log/vmware/ | grep Access

      Expected output: Exit code 0 and Access: (0755/drwxr-xr-x).
      
      

6. Verify configuration and restart the service:
   

   logrotate -v /etc/logrotate.conf 2>&1 | grep -iE "error|skipping"
   systemctl restart logrotate && systemctl status logrotate

Additional Information

Remaining skipping entries in logrotate -v output for non-existent files (such as /var/log/warn or /var/log/vmware/messages) are expected behavior if those optional services or targets are inactive on the node.