rsyslog error 2433

Error other than “not found” occurred during open(): OS ERROR MESSAGE

There was a problem opening a file. The “OS ERROR MESSAGE” is taken from the OS and tells what exactly caused the issue.

A common cause is “Permission Denied” which means the rsyslog process had insufficient permissions to open the file. This can be caused by several things, with the most common being

  • access permissions to restrictive
  • SELinux policies (or similar systems, like AppArmor)

Note that in the case of SELinux and friends  running as root does not solve the permission issue, because it is a design goal of these tools to be able to restrict permissions even for privileged processes.

Additional help is also available in “solving rsyslog write errors“.

4 thoughts on “rsyslog error 2433

  1. Getting the same error in a container complaining about read permission on a non-existent file. SELinux is not being used. There is no /var/log/syslog file in the container. How do I get rid of this msg? Looked at the documentation for this and it does not cover the case where the file being flagged does not even exist (so why a permission error on it?)

    rsyslogd: file ‘/var/log/syslog’: open error: Permission denied [v8.32.0 try http://www.rsyslog.com/e/2433 ]

    /# ls /var/log/syslog
    ls: cannot access ‘/var/log/syslog’: No such file or directory

    Thanks,
    Kevin

  2. Jan 2 12:03:26 localhost rsyslogd: file \’/mss/syslog/fgt-01.log\’: open error: Permission denied [v8.24.0-34.el7 try http://www.rsyslog.com/e/2433 ]

    config file:
    $umask 0000
    # Log remote hosts to separate log file
    $fileCreateMode 0640
    $fileOwner root
    $fileGroup netsec
    $template PerHostLog,\”/mss/syslog/%HOSTNAME%.log\”
    $template RemoteHostFileFormat,\”%PRI%1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\\n\”
    :inputname, isequal, \”imudp\” ?PerHostLog;RemoteHostFileFormat
    #:inputname, isequal, \”imtcp\” ?PerHostLog;RemoteHostFileFormat
    & ~

      1. Well, assuming you comment on the initial sample: “Permission denied” is the actual error as it comes from the OS (this is where we obtain it). So you need to fix permissions. Note that in 2019’s Linux this may also mean things like SELinux. What exactly is the cause of the permission issue is not said by the OS, so rsyslog cannot report it.

Leave a Reply

Scroll to top