Doh, this is so obvious it's embarrassing.
rsyslog is dropping privileges to 'rsyslog:rsyslog'
/var/log is set as follows:
drwxr-xr-x 14 root root 4096 2009-08-16 07:20 /var/log
The files appear to be created before the privileges are dropped - hence why it seems to work for a bit and then stops.
-rw-r----- 1 root adm 88 2009-08-16 08:39 kern.log -rw-r----- 1 root adm 354 2009-08-16 08:39 syslog -rw-r----- 1 root adm 354 2009-08-16 08:39 messages
Plus the console has the wrong permissions.
prw-r----- 1 root adm 0 2009-08-16 08:47 /dev/xconsole
And of course when you HUP the syslog daemon it reopens the files and gets permission denied.
So we need to get the permissions sorted out - and figure out why rsyslog is able to open the log files are root.
Which package does the initial create on /var/log?
Doh, this is so obvious it's embarrassing.
rsyslog is dropping privileges to 'rsyslog:rsyslog'
/var/log is set as follows:
drwxr-xr-x 14 root root 4096 2009-08-16 07:20 /var/log
The files appear to be created before the privileges are dropped - hence why it seems to work for a bit and then stops.
-rw-r----- 1 root adm 88 2009-08-16 08:39 kern.log
-rw-r----- 1 root adm 354 2009-08-16 08:39 syslog
-rw-r----- 1 root adm 354 2009-08-16 08:39 messages
Plus the console has the wrong permissions.
prw-r----- 1 root adm 0 2009-08-16 08:47 /dev/xconsole
And of course when you HUP the syslog daemon it reopens the files and gets permission denied.
So we need to get the permissions sorted out - and figure out why rsyslog is able to open the log files are root.
Which package does the initial create on /var/log?