SC_ERR_LOGDIR_CONFIG(116)] - The logging directory "/var/log/suricata/" supplied by /etc/suricata//suricata.yaml (default-log-dir) is not writable

Help
1

I am seeing below error when I am running the test
test@Ubuntu:~$ suricata -T
23/6/2022 – 20:37:03 - - Running suricata under test mode
23/6/2022 – 20:37:03 - - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
23/6/2022 – 20:37:03 - - [ERRCODE: SC_ERR_LOGDIR_CONFIG(116)] - The logging directory “/var/log/suricata/” supplied by /etc/suricata//suricata.yaml (default-log-dir) is not writable. Shutting down the engine
test@Ubuntu:~$

OS details:
test@Ubuntu:~$ cat /etc/os-release
PRETTY_NAME=“Ubuntu 22.04 LTS”

In the selinux - semanage.conf
below are the uncommented lines
module-store = direct
expand-check=0

suricata.yaml- details
default-log-dir: /var/log/suricata/

the file /var/log/suricata.log - has been made chmod 777

I am still getting this error.

Regards
vpcap

2

The logging directory permissions are causing the issue; you can view them with ls -ld /var/log

You can

  • Change the logging directory used by Suricata by adding -l /path/to/new/logdir to the command line
  • Or, change the value of default-log-dir to a directory to which your userid has write permissions
  • Or, start Suricata with sudo
1 Like