Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change nginx log directory owner to fix log rotation #8

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

waj-kubiak
Copy link

@waj-kubiak waj-kubiak commented Feb 2, 2022

Prior to this change, /var/log/nginx was owned by root. This resulted in a broken log rotation where nginx worker processes would continue to write to a rotated file access.log.1 with no further rotation until there's no disk space left. New log file access.log.0 would remain empty.

Changing the owner user to www-data so that it correlates with nginx and logrotate config files resolves the issue. Usually instances don't last long enough for this to be a problem, however it's been observed on few meter-points-service instances.

Tested with Vagrant, got no errors related to the change:
==> webhookserver: Notice: /Stage[main]/Octo_nginx/File[nginx log dir]/owner: owner changed 'root' to 'www-data'

Tested on an api-server instance on oegb-test after CIS hardening cron job kicks in:

Screenshot 2022-04-01 at 16 58 08

Screenshot 2022-04-01 at 17 06 17

@waj-kubiak
Copy link
Author

Never mind this PR, this is likely the cause:

  # 5.4.4 Ensure default user umask is 027 or more restrictive
  file_line { "Ensure default user umask is 027 or more restrictive":
    path => "/etc/profile",
    line => "umask 027",
    match => "^umask "
  }

@waj-kubiak waj-kubiak closed this Feb 16, 2022
@waj-kubiak waj-kubiak reopened this Apr 1, 2022
@waj-kubiak waj-kubiak force-pushed the fix-nginx-log-dir-ownership branch from da61c98 to 95aec3c Compare April 1, 2022 13:53
@waj-kubiak waj-kubiak force-pushed the fix-nginx-log-dir-ownership branch from 95aec3c to 2c79659 Compare April 1, 2022 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants