mjhjmtu

The error

I installed Elasticsearch on CentOS using rpm and am encountering this error when I try to start it via systemctl start elasticsearch:

Feb 20 21:08:34 server.cberdata.org systemd[1]: Started Elasticsearch.
Feb 20 21:08:34 server.cberdata.org elasticsearch[4226]: OpenJDK 64-Bit Server VM warning: Cannot open file /var/log/elasticsearch/gc.log due to Permission denied
Feb 20 21:08:51 server.cberdata.org systemd[1]: elasticsearch.service: main process exited, code=exited, status=78/n/a
Feb 20 21:08:51 server.cberdata.org systemd[1]: Unit elasticsearch.service entered failed state.
Feb 20 21:08:51 server.cberdata.org systemd[1]: elasticsearch.service failed.

Notably: Cannot open file /var/log/elasticsearch/gc.log due to Permission denied

Permissions

Permissions for /var:

drwxr-xr-x 21 root root 4096 Feb 11 19:10 var

Permissions for /var/log:

drwxrwxr-- 12 root root 4096 Feb 20 21:00 log

Permissions for /var/log/elasticsearch:

drwxrwxrwx 2 elasticsearch elasticsearch 4096 Feb 20 20:56 elasticsearch

Permissions for /var/log/elasticsearch/gc.log

(which I manually created to see if that would help, but doing so had no effect on the error):

-rwxrwxrwx 1 elasticsearch elasticsearch 0 Feb 20 20:56 gc.log

Setting /var/log permissions to drwxrwxrwx appears to fix the problem, but I'm hesitant to do that because it seems insecure and it results in these new errors:

/etc/cron.daily/logrotate:
error: skipping "/var/log/exim_mainlog" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

Am I correct that systemctl / systemd is running this service as the elasticsearch user? If it's doing that, how can the owner of the file and its directory, with apparent read/write/execute permissions, not have permission to open that file?

The directory /var/log has 774 permissions. As the execute bit isn't set, the elasticsearch user can't traverse the directory to get the elasticsearch directory and the gc.log file contained therein.

Normally, the /var/log directory has 755 permissions or else no services or applications running as anyone other than root would be able to write to it.

You can fix it by using:

chmod 755 /var/log

You also don't need to have 777 permissions on the elasticsearch directory and the log file. The can use a variation of the above command to set the permissions:

chmod -R 755 /var/log/elasticsearch