Log permission

[bluecircle]

Hi all, in my freebsd FreeBSD 8.2 installation when I receve the mail security output I read this message:

mv: rename /var/log/pf.today to /var/log/pf.yesterday: Operation not permitted
mv: rename /tmp/security.Ya9pi6ZG to /var/log/pf.today: Operation not permitted

mv: rename /var/log/dmesg.today to /var/log/dmesg.yesterday: Operation not permitted
mv: rename /tmp/security.WKSnUZuq to /var/log/dmesg.today: Operation not permitted

How to fix it?
Thank you.

 

[SirDice]

What are the permissions on those PF files?

root@maelcum:~#ll /var/log/pf*
-rw-------  1 root  wheel         0 Jan 23 03:01 /var/log/pf.today
-rw-------  1 root  wheel      1040 Jan 22 03:01 /var/log/pf.yesterday
-rw-------  1 root  wheel  27570509 Jan 23 08:34 /var/log/pflog
-rw-------  1 root  wheel   1695530 Jan 23 08:00 /var/log/pflog.0.bz2
-rw-------  1 root  wheel   4307295 Jan 22 20:59 /var/log/pflog.1.bz2
-rw-------  1 root  wheel   8651830 Jan 22 15:00 /var/log/pflog.2.bz2
-rw-------  1 root  wheel   8821994 Jan 22 14:00 /var/log/pflog.3.bz2
root@maelcum:~#

 

[fluca1978]

Could it be a flag set on the files? Try with # ls -lo.

 

[bluecircle]

Thanks for replies.

# ls -lo /var/log/pf*
-rw-------  1 root  wheel  -            0 Jan  4 03:01 /var/log/pf.today
-rw-------  1 root  wheel  sappnd 2143716 Jan 24 09:17 /var/log/pflog

I use newsyslog and have this line

/var/log/pflog                          600  3     100  *     JB    /var/run/pflogd.pid

 

[SirDice]

-rw-------  1 root  wheel  [B]sappnd[/B] 2143716 Jan 24 09:17 /var/log/pflog

Those flags shouldn't be there.

# chflags nosappnd /var/log/pflog

 

[bluecircle]

Thanks all I have solved