Ubuntu 16.04 LTS rsyslog stops writing logs after permission regression

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security and troubleshooting visibility is lost because new logs are not persisted.

Environment & Reproduction

Appears after manual chmod/chown, restore scripts, or filesystem remount changes.

Root Cause Analysis

rsyslog cannot write to target paths due to restrictive permissions or missing directories.

Quick Triage

Check daemon status and immediate write errors before rotating or purging logs.

Step-by-Step Diagnosis

Inspect rsyslog config includes and filesystem ACL/mode states on destination paths.

Solution – Primary Fix

Restore correct ownership and permissions, then restart rsyslog safely.

Solution – Alternative Approaches

Redirect to alternative writable path while remediating original log storage.

Verification & Acceptance Criteria

New log entries appear in expected files and remote forwarding works.

Rollback Plan

Reapply previous logging config and ownership map from system backup.

Prevention & Hardening

Monitor log write failures and enforce immutable permission baselines.

Related Errors & Cross-Refs

omfile: open error, permission denied, and stopped processing action messages.

Related tutorial: View the step-by-step tutorial for Ubuntu 16.04 LTS.

View all Ubuntu 16.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

rsyslog reliability and file permission controls for Ubuntu hosts.