topic Re: Metadata server log permission in Administration and Deployment

Metadata server log permission

sathya66 — Wed, 03 Jun 2020 09:23:05 GMT

All,

Currently our SASMeta_MetadataServer.log log permissions are set to 600 .How can we set the metadata server log file permission to 644.

I tried to set the permissions in logconfig.xml in metadata server but it didn't help us as that file has Rolling log file with default rollover of midnight.

is there anyway we can set to 644 or please can you advise on this.

Thanks,

Re: Metadata server log permission

AnandVyas — Wed, 03 Jun 2020 11:01:06 GMT

Does only the Metadata logs are generated with 600 permission or any file created using 'SAS Installer Account' with same permission?

Could you please share how did you change this config in logconfig.xml file?

you can try to set umask value for the 'SAS Installer Account' to 0022. This will generate all the files by this ID with permission of 644. You can add this in .bashrc file for this user.

Re: Metadata server log permission

sathya66 — Wed, 03 Jun 2020 12:32:15 GMT

Yes all files created using SAS installer account has 600 permissions (ex: objectspwaner,metadata,etc but not the mid tier server logs have 640 permissions).
I changed like below
<param name="FilePermissions" value="A::u::rw-,A::g::---,A::o::---"/>
it worked in Workspace server logconfig file as that one doesn't have rolling log.

I am looking for only logs with 644 permissions. If I change umask to 0022 in .bashrc then it is for all files which is created by sas installer account?

Re: Metadata server log permission

alexal — Wed, 03 Jun 2020 12:59:10 GMT

If I change umask to 0022 in .bashrc then it is for all files which is created by sas installer account?

Yes.

Re: Metadata server log permission

sathya66 — Wed, 03 Jun 2020 13:05:52 GMT

Ignore me.
It worked ,If I change logconfig.xml file
from <param name="FilePermissions" value="A::u::rw-,A::g::---,A::o::---"/>
to <param name="FilePermissions" value="A::u::rw-,A::g::r--,A::o::r--"/>
group and other should have "r--".

Thanks for your response and help.

Re: Metadata server log permission

gwootton — Wed, 03 Jun 2020 13:11:00 GMT

The FilePermissions parameter is valid for the RollingFileAppender. Did you restart the Metadata Server after making the change?

SAS® 9.4 Logging: Configuration and Programming Reference - RollingFileAppender

Your example seems to indicate you are setting the permissions to 600 instead of 644. Here is the example from the documentation:

Example

The following parameter sets permissions that enable only the owning user to write to the log file. All other users can only read the file.

<param name="FilePermissions" value="A::u::rw-,A::g::r--,A::o::r--"/>

Re: Metadata server log permission

sathya66 — Wed, 03 Jun 2020 13:23:07 GMT

Yes, I wanted to see the file permissions straight away after making the change so I restarted the metadata server otherwise I need to wait until next day to see the file permission is changed or not .
I think we don't need to restart the metadata server.

Re: Metadata server log permission

gwootton — Wed, 03 Jun 2020 13:55:38 GMT

The contents of the log configuration file are only read during startup, so changes would not be read in unless the server is restarted.
For on-demand servers like a Workspace Server this means the log configuration is read when the next Workspace Server starts, but for persistent servers like Object Spawners and Metadata a restart is required.

Re: Metadata server log permission

sathya66 — Tue, 29 Mar 2022 11:10:03 GMT

By setting up the permissions like this. It is only creating a file with 644 permissions after restarting metadata server but not giving the 644 permissions for every day logs.Any idea?

Our logs rotates every day(time-based ).

See below on 19^th we restarted metadata server so it has given 644 but remaining logs it is with 600 only

Re: Metadata server log permission

gwootton — Tue, 29 Mar 2022 20:46:07 GMT

You may wish to engage SAS Technical Support to review the configuration and behavior.