0
$ ruby -v
ruby 1.8.7 (2010-01-10 patchlevel 249) [x86_64-linux]

This is the important line on the script (/etc/munin/plugins/nginx_status_codes.rb:31):

File.open("/var/log/nginx/access.log", File::RDONLY).readlines.each do |line|

My access log has global read permissions:

$ ls -lha /var/log/nginx/access.log
-rw-r--r-- 1 www-data adm 49M May  1 15:56 /var/log/nginx/access.log

The script works if I run from the terminal as a regular user...

$ /etc/munin/plugins/nginx_status_codes > /dev/null && echo $?
0

...but it fails if ran by Munin (which runs as root):

2012/05/01-15:54:05 [3988]  /etc/munin/plugins/nginx_status_codes:31:in `initialize': Permission denied - /var/log/nginx/access.log (Errno::EACCES)
2012/05/01-15:54:05 [3988]      from /etc/munin/plugins/nginx_status_codes:31:in `open'
2012/05/01-15:54:05 [3988]      from /etc/munin/plugins/nginx_status_codes:31

It also fails if I set the file permissions to 777 or whatever. I'm thinking Ruby is just being stupid and reporting the wrong exception (Errno:EACCES) and masquerading the real issue. But what would it be?

UPDATE: Tried to "fix" it by having the script owned by root:root and even with sid/gid bits set it manages to fail with permission denied.

hcalves
  • 2,268
  • 1
  • 21
  • 17
  • 1
    I'm not familiar with Munin. Does it really run as root? Doesn't it switch to another user id after initialization? If it does, then does that user id have access to the /var, /var/log, and /var/log/nginx directories? – theglauber May 01 '12 at 19:13
  • I have Munin running both as user and group "root" as per munin.cfg. But you may be right, it might be the case that it drops the root user when running the script, though. What I find strange is that I can run the script as a regular user without facing permission issues. – hcalves May 01 '12 at 19:30

1 Answers1

1

Nevermind. The problem was that logrotation was in place and it changed the log file permissions every now and then:

$ cat /etc/logrotate.d/nginx 
/var/log/nginx/*.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
            run-parts /etc/logrotate.d/httpd-prerotate; \
        fi; \
    endscript
    postrotate
        [ ! -f /var/run/nginx.pid ] || kill -USR1 `cat /var/run/nginx.pid`
    endscript
}
hcalves
  • 2,268
  • 1
  • 21
  • 17
  • To signal nginx to reopen the log files: http://wiki.nginx.org/CommandLine#Stopping_or_Restarting_Nginx – hcalves May 01 '12 at 20:17