FreeBSD 13 – syslog rotation fails with permission denied on /var/log – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Log files stop rotating, risking disk saturation and observability loss.

Environment & Reproduction

Occurs after manual ownership changes or restrictive ACL modifications.

Root Cause Analysis

newsyslog lacks permissions on one or more configured log targets.

Quick Triage

Identify first failing file path and validate mode and owner settings.

Step-by-Step Diagnosis

Run dry-run rotation and inspect log file metadata hierarchy.

Solution – Primary Fix

Restore expected ownership/mode and test scheduled rotation tasks.

Solution – Alternative Approaches

Relocate custom logs to dedicated directory with explicit policy controls.

Verification & Acceptance Criteria

Rotation runs complete and archived logs are created as configured.

Rollback Plan

Reapply previous newsyslog.conf and file metadata baseline.

Prevention & Hardening

Guard log path permissions with configuration management checks.

Related Errors & Cross-Refs

May occur with immutable flags or read-only filesystem transitions.

Related tutorial: View the step-by-step tutorial for FreeBSD 13.

View all FreeBSD 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

newsyslog.conf(5), syslogd(8), and FreeBSD logging handbook content.