mjhjmtu

I see my file permissions are changing automatically , to test I have kept the permssions chmod 750 to all alert file in /var/log/snort-* after some time when alert file updated the permission got changed automatically please seethe bold ones below

find /var/log/ -name "alert" | xargs ls -ltr
-rw-r----- 1 root root 0 Jan 2 20:31 /var/log/snort/alert
-rwxr-x--- 1 snort snort 34072366 Feb 1 16:27 /var/log/snort-28/alert
-rwxr-x--- 1 snort snort 75063436 Feb 1 16:27 /var/log/snort-19/alert
-rwxr-x--- 1 snort snort 16311468 Feb 1 16:27 /var/log/snort-30/alert
-rwxr-x--- 1 snort snort 79884541 Feb 1 16:27 /var/log/snort-16/alert
-rwxr-xr-x 1 snort snort 104905721 Feb 1 16:27 /var/log/snort-1/alert
-rwxr-x--- 1 snort snort 34544347 Feb 1 16:27 /var/log/snort-24/alert
-rwxr-xr-x 1 snort snort 93270532 Feb 1 16:27 /var/log/snort-0/alert
-rw------- 1 snort snort 398030 Feb 1 16:27 /var/log/snort-27/alert
-rwxr-x--- 1 snort snort 124223452 Feb 1 16:27 /var/log/snort-8/alert
-rwxr-x--- 1 snort snort 70808479 Feb 1 16:27 /var/log/snort-5/alert
-rwxr-x--- 1 snort snort 36275553 Feb 1 16:27 /var/log/snort-15/alert
-rwxr-x--- 1 snort snort 17365347 Feb 1 16:27 /var/log/snort-9/alert
-rwxr-x--- 1 snort snort 112000757 Feb 1 16:27 /var/log/snort-12/alert
-rwxr-x--- 1 snort snort 57244741 Feb 1 16:27 /var/log/snort-4/alert
-rwxr-x--- 1 snort snort 33943973 Feb 1 16:27 /var/log/snort-7/alert
-rwxr-x--- 1 snort snort 7480744 Feb 1 16:28 /var/log/snort-11/alert
-rwxr-x--- 1 snort snort 120967271 Feb 1 16:28 /var/log/snort-21/alert
-rwxr-x--- 1 snort snort 39321621 Feb 1 16:28 /var/log/snort-13/alert
-rwxr-xr-x 1 snort snort 78907524 Feb 1 16:28 /var/log/snort-2/alert
-rwxr-x--- 1 snort snort 120505554 Feb 1 16:28 /var/log/snort-10/alert
-rwxr-x--- 1 snort snort 123510708 Feb 1 16:28 /var/log/snort-22/alert
-rwxr-x--- 1 snort snort 37705193 Feb 1 16:28 /var/log/snort-20/alert
-rwxr-x--- 1 snort snort 17115219 Feb 1 16:28 /var/log/snort-6/alert
-rwxr-x--- 1 snort snort 19318806 Feb 1 16:28 /var/log/snort-23/alert
-rwxr-x--- 1 snort snort 11678050 Feb 1 16:28 /var/log/snort-14/alert
-rw------- 1 snort snort 2813938 Feb 1 16:28 /var/log/snort-18/alert
-rwxr-x--- 1 snort snort 11182293 Feb 1 16:28 /var/log/snort-3/alert
-rw------- 1 snort snort 2231847 Feb 1 16:28 /var/log/snort-29/alert
-rwxr-x--- 1 snort snort 38157904 Feb 1 16:28 /var/log/snort-25/alert
-rwxr-x--- 1 snort snort 20220138 Feb 1 16:28 /var/log/snort-26/alert
-rwxr-x--- 1 snort snort 122715343 Feb 1 16:28 /var/log/snort-17/alert
-rwxr-x--- 1 snort snort 120842518 Feb 1 16:28 /var/log/snort-31/alert

[root@jumpo1 snort-1]# grep snort /etc/group
snort:x:40000:logstash,root

Any clue why this is happening how to preserve permssions I want to be keep chmod 750 to all alert files, no one should change that even root.

I am using linux version

[root@jumpo1 snort-1]# uname -a
Linux jumpo1 3.10.0-514.el7.x86_64 x86_64 x86_64 x86_64 GNU/Linux

I can give you a temporary solution meanwhile you found the reason, you can put a cron to change the file permissions.

crontab -e

and then

* * * * * chmod 750 /var/log/snort-*

Most probably logrotate is the culprit. Check /etc/logrotate.d for a configuration file that deals with the snort logs. In there, you can specifiy the access rights you prefer. But if the problem is with new logs, then you can set the umask before snort is started.