topic Log file permissions on Linux in ArcGIS Enterprise Questions

Log file permissions on Linux

JoanneMcGraw — Fri, 29 Nov 2013 17:22:10 GMT

Does anyone know if ArcGIS Server and the Web Adaptor are giving only their owners read access to the log files they create by default?

Is seems the system settings for new files and directories created by that user are being ignored. More importantly, if that is the case, does anyone know where/what we can configure to provide its group with read access as well?

Cheers,
jtm

Re: Log file permissions on Linux

BubbaHey — Thu, 05 Dec 2013 13:13:37 GMT

What is the path for the log files? I thought they were under <serverinstall>/usr/logs - but no logs under /usr

Re: Log file permissions on Linux

JoanneMcGraw — Thu, 05 Dec 2013 13:54:32 GMT

Our log files are under <serverinstall>/usr/logs, as you suggest. Actually, they are under <serverinstall>/usr/logs/<hostname>, I assume because we have a cluster of two ArcGIS Servers set up. It's the same on both servers; although the hostname is different, of course.

If you do not have a logs directory under usr, that suggests they are configurable in some way; at least in terms of their location. Hopefully, in terms of their permissions also.

Cheers,
jtm

Re: Log file permissions on Linux

BubbaHey — Thu, 05 Dec 2013 16:09:32 GMT

Thanks, I'm still looking. Mine was an upgrade from 10.1 - don't know if that is a factor.

Re: Log file permissions on Linux

ThomasMontefusco — Thu, 05 Dec 2013 16:39:40 GMT

Bubbahey, look in /arcgis/server/usr/logs, it sounds like you were looking in the ArcGISServer folder (I could be wrong)..

On a default install of ArcGIS Server, my permissions for the logs folder are drwx

Re: Log file permissions on Linux

ThomasMontefusco — Thu, 05 Dec 2013 16:40:37 GMT

Sorry cut off -
drwxr-xr-x

Re: Log file permissions on Linux

BubbaHey — Thu, 05 Dec 2013 16:42:49 GMT

Ah.... you are correct. Duh. 🙂

My permissions are the same.

Re: Log file permissions on Linux

JoanneMcGraw — Fri, 06 Dec 2013 11:23:17 GMT

Sorry cut off -
drwxr-xr-x

Tom/Bubba,
Thank you for your responses.

Are your log file permissions similar? I can get into the directory but, for example, the files under server are only read/write for the ArcGIS user. I can't view their contents as a member of the ArcGIS user group.

Cheers,
jtm

Re: Log file permissions on Linux

BubbaHey — Fri, 06 Dec 2013 12:39:14 GMT

As mentioned, mine is an upgrade from 10.1 to 10.2 for my arcgis user I have read/write/execute permissions. But this is an upgrade, I don't know if those are default permissions.

Re: Log file permissions on Linux

JoanneMcGraw — Tue, 10 Dec 2013 14:02:16 GMT

I contacted ESRI Support about this question and detailed some additional info to them:

In our environment, our ArcGIS Server user has a umask command in its profile that sets its create permissions to 640 (the '4' indicates members of the same group should get read and execute permissions - the execute permissions are necessary in case it's a directory so the group member can "cd" into it). Since the ArcGIS Server is started with the ArcGIS Server user's account, we expected it to use those settings. Instead, new log files continue to be created with 600 permissions.

So, is ArcGIS Server code overriding the umask settings somehow?

And, their response:

Yes, ArcGIS Server will create a file with access for ArcGIS Server account only. It is recommended not to access the log files from outside of ArcGIS Server Manager.

Since ArcGIS Server Manager doesn't provide search capabilities on the logs or the ability to load the entire contents of, say, a VERBOSE-level log in one screen (and because we can't think of any rational reason why granting group members read permissions on those files should be problematic), we're just going to ignore that limitation and continue overwriting ArcGIS Server's permissions for the account after the files are created; pain that that is.

I'll let you know if doing so results in any problems.

Cheers,
jtm

Re: Log file permissions on Linux

BubbaHey — Tue, 10 Dec 2013 15:29:57 GMT

Thanks for the information! Also, yes I prefer to view log in Server Manager, but sometimes you can't get to Server Manager, so you would need to access the logs from that location and hope, maybe the logs give an idea as to what is wrong.

Re: Log file permissions on Linux

JonathanEpstein — Thu, 30 Sep 2021 16:45:24 GMT

I'm responding to a very old post here; hopefully someone will see this.

We need to be able to track these logs using a log-aggregator, in our case 'splunk'. It will be simple enough to add the 'splunk' user to the arcgis group. But the arcgis directories are stored with 700 permissions, and the log files with 600 permissions.

We want to use 750 and 640 permissions, so that a member of the same GROUP can read the files.

How can we override the umask associated with the creation of these log files and their parent directories?