1

I've tried setting up Cacti on CentOS 6 with mariadb, nginx 1.4, php 5.4.x

I just can't get the graphs to update

My cacti files are all owned by user nginx, so my crontab file /etc/cron.d/cacti has

*/5 * * * *     nginx       /usr/bin/php -q /usr/share/nginx/html/cacti/poller.php > /var/local/log/poller.log 2>&1

However, I see that it is run in the cron log, but it does not produce any output in the poller.log and it does not update the cacti.log.

Oct 13 12:20:01 srv CROND[14644]: (nginx) CMD (      /usr/bin/php -q usr/share/nginx/html/cacti/poller.php > /var/local/log/poller.log 2>&1)

I can run sudo -u nginx /usr/bin/php -q /usr/share/nginx/html/cacti/poller.php and see output and it seems to update the .rrd files. Also, I've run this once sudo -u nginx php -q cli/rebuild_poller_cache.php and somehow I've gotten one datapoint on the graph, but I've not been able to even manually update the graphs anymore.

There doesn't seem to be anything helpful in the cacti.log (which is only updated when running manually). I also didn't see anything in the /var/log/secure regarding SELinux, but I may have missed it (not sure what to look for).

Where should I look to fix this? Why doesn't the cronjob work even though it is running? How can I get the graphs to update again?

Update: I think I see the problem. I hadn't looked at the permissions of the actual rra folder, only it's symlink. I'll try fixing that.

Permissions of relevant rra files:

$ lll /usr/share/nginx/html/cacti/rra
lrwxrwxrwx. 1 nginx nginx 18 Oct 12 23:21 /usr/share/nginx/html/cacti/rra -> /var/lib/cacti/rra
$ lll /usr/share/nginx/html/cacti/rra/
total 340
drwxr-xr-x. 2 cacti root    4096 Oct 13 00:32 .
drwxr-xr-x. 5 root  root    4096 Oct 12 23:21 ..
-rw-r--r--. 1 nginx nginx 141640 Oct 13 12:12 localhost_load_1min_5.rrd
-rw-r--r--. 1 nginx nginx  47992 Oct 13 12:12 localhost_mem_buffers_3.rrd
-rw-r--r--. 1 nginx nginx  47992 Oct 13 12:12 localhost_mem_swap_4.rrd
-rw-r--r--. 1 nginx nginx  47992 Oct 13 12:12 localhost_proc_7.rrd
-rw-r--r--. 1 nginx nginx  47992 Oct 13 12:12 localhost_users_6.rrd
$ lll /var/lib/cacti/
total 20
drwxr-xr-x.  5 root  root 4096 Oct 12 23:21 .
drwxr-xr-x. 38 root  root 4096 Oct 12 23:21 ..
drwxr-xr-x.  2 root  root 4096 Oct 12 23:21 cli
lrwxrwxrwx.  1 root  root   24 Oct 12 23:21 include -> /usr/share/cacti/include
lrwxrwxrwx.  1 root  root   20 Oct 12 23:21 lib -> /usr/share/cacti/lib
drwxr-xr-x.  2 cacti root 4096 Oct 13 00:32 rra
drwxr-xr-x.  2 root  root 4096 Oct 12 23:21 scripts

Here is the part of my audit.log (it's very repetitive)

[matt@srv ~]$ sudo cat /var/log/audit/audit.log | grep denied
type=AVC msg=audit(1381785901.286:31729): avc:  denied  { getattr } for  pid=22067 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
type=AVC msg=audit(1381786201.333:31742): avc:  denied  { getattr } for  pid=22087 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
type=AVC msg=audit(1381786501.374:31749): avc:  denied  { getattr } for  pid=22114 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
type=AVC msg=audit(1381786801.418:31762): avc:  denied  { getattr } for  pid=22134 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
type=AVC msg=audit(1381787101.450:31769): avc:  denied  { getattr } for  pid=22151 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
type=AVC msg=audit(1381787401.493:31782): avc:  denied  { getattr } for  pid=22171 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
type=AVC msg=audit(1381787701.543:31789): avc:  denied  { getattr } for  pid=22188 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
type=AVC msg=audit(1381788001.595:31800): avc:  denied  { getattr } for  pid=22208 comm="postdrop" path="/var/spool/postfix/public/pickup" dev=dm-0 ino=2224026 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postfix_public_t:s0 tclass=sock_file
Matt
  • 135
  • 1
  • 7
  • The selinux audit log is usually at `/var/log/audit/audit.log`. Can you check and post relevant `denied` errors? Also, have you checked the permissions of files in the RRD directory to make sure they are all owned by the `nginx` user? – Andy Shinn Oct 14 '13 at 02:38
  • My update explains part of the issue. Now I'm successfully running the poller (the log is populated). But I don't see any graphs...perhaps there is something else where permissions are wrong. The `audit.log` seems to refer to sending emails, which is okay with me for now. – Matt Oct 14 '13 at 22:21
  • Update again, graphs are working, I just had to wait – Matt Oct 14 '13 at 22:27

1 Answers1

1

I had to fix permissions for the parent of the symlink'd directories

/var/lib/cacti/rra

/var/log/cacti

Notice:

$ ll /usr/share/cacti/
total 868
...
lrwxrwxrwx. 1 nginx nginx    18 Oct 12 23:21 cli -> /var/lib/cacti/cli
...
lrwxrwxrwx. 1 nginx nginx    15 Oct 12 23:21 log -> /var/log/cacti/
...
lrwxrwxrwx. 1 nginx nginx    18 Oct 12 23:21 rra -> /var/lib/cacti/rra
...
lrwxrwxrwx. 1 nginx nginx    22 Oct 12 23:21 scripts -> /var/lib/cacti/scripts

Fixed:

chown -R nginx:nginx /var/log/cacti/
chown -R nginx:nginx /var/lib/cacti/rra
Matt
  • 135
  • 1
  • 7