nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Log file permissions on Linux

JoanneMcGraw

Does anyone know if ArcGIS Server and the Web Adaptor are giving only their owners read access to the log files they create by default?

Is seems the system settings for new files and directories created by that user are being ignored. More importantly, if that is the case, does anyone know where/what we can configure to provide its group with read access as well?

Cheers,
jtm

Trouver plus de publications taguées avec

Accepted answers

JoanneMcGraw

I contacted ESRI Support about this question and detailed some additional info to them:

In our environment, our ArcGIS Server user has a umask command in its profile that sets its create permissions to 640 (the '4' indicates members of the same group should get read and execute permissions - the execute permissions are necessary in case it's a directory so the group member can "cd" into it). Since the ArcGIS Server is started with the ArcGIS Server user's account, we expected it to use those settings. Instead, new log files continue to be created with 600 permissions.

So, is ArcGIS Server code overriding the umask settings somehow?

And, their response:

Yes, ArcGIS Server will create a file with access for ArcGIS Server account only. It is recommended not to access the log files from outside of ArcGIS Server Manager.

Since ArcGIS Server Manager doesn't provide search capabilities on the logs or the ability to load the entire contents of, say, a VERBOSE-level log in one screen (and because we can't think of any rational reason why granting group members read permissions on those files should be problematic), we're just going to ignore that limitation and continue overwriting ArcGIS Server's permissions for the account after the files are created; pain that that is.

I'll let you know if doing so results in any problems.

Cheers,
jtm

All comments

BubbaHey

What is the path for the log files? I thought they were under <serverinstall>/usr/logs - but no logs under /usr

JoanneMcGraw

Our log files are under <serverinstall>/usr/logs, as you suggest. Actually, they are under <serverinstall>/usr/logs/<hostname>, I assume because we have a cluster of two ArcGIS Servers set up. It's the same on both servers; although the hostname is different, of course.

If you do not have a logs directory under usr, that suggests they are configurable in some way; at least in terms of their location. Hopefully, in terms of their permissions also.

Cheers,
jtm

BubbaHey

Thanks, I'm still looking. Mine was an upgrade from 10.1 - don't know if that is a factor.

ThomasMontefusco

Bubbahey, look in /arcgis/server/usr/logs, it sounds like you were looking in the ArcGISServer folder (I could be wrong)..

On a default install of ArcGIS Server, my permissions for the logs folder are drwx

ThomasMontefusco

Sorry cut off -
drwxr-xr-x

BubbaHey

Ah.... you are correct. Duh. 🙂

My permissions are the same.

JoanneMcGraw

Sorry cut off -
drwxr-xr-x

Tom/Bubba,
Thank you for your responses.

Are your log file permissions similar? I can get into the directory but, for example, the files under server are only read/write for the ArcGIS user. I can't view their contents as a member of the ArcGIS user group.

Cheers,
jtm

BubbaHey

As mentioned, mine is an upgrade from 10.1 to 10.2 for my arcgis user I have read/write/execute permissions. But this is an upgrade, I don't know if those are default permissions.

JoanneMcGraw

I contacted ESRI Support about this question and detailed some additional info to them:

In our environment, our ArcGIS Server user has a umask command in its profile that sets its create permissions to 640 (the '4' indicates members of the same group should get read and execute permissions - the execute permissions are necessary in case it's a directory so the group member can "cd" into it). Since the ArcGIS Server is started with the ArcGIS Server user's account, we expected it to use those settings. Instead, new log files continue to be created with 600 permissions.

So, is ArcGIS Server code overriding the umask settings somehow?

And, their response:

Yes, ArcGIS Server will create a file with access for ArcGIS Server account only. It is recommended not to access the log files from outside of ArcGIS Server Manager.

BubbaHey

Thanks for the information! Also, yes I prefer to view log in Server Manager, but sometimes you can't get to Server Manager, so you would need to access the logs from that location and hope, maybe the logs give an idea as to what is wrong.

JonathanEpstein

I'm responding to a very old post here; hopefully someone will see this.

We need to be able to track these logs using a log-aggregator, in our case 'splunk'. It will be simple enough to add the 'splunk' user to the arcgis group. But the arcgis directories are stored with 700 permissions, and the log files with 600 permissions.

We want to use 750 and 640 permissions, so that a member of the same GROUP can read the files.

How can we override the umask associated with the creation of these log files and their parent directories?

Rejoindre la conversation

Les membres connectés peuvent publier, suivre les mises à jour, et plus encore. Nouveau ici ? Inscrivez-vous gratuitement.

Liens rapides

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.