I’m having an issue whereby my workers are crashing due to interface issues (but that’s another story). The problem I’d like to discuss here is that when I attempt to re-start the workers, I run into a permissions issue:
“Error: error running post-terminate for worker-4: mv: cannot move ‘/opt/zeek/spool/worker-4’ to ‘/opt/zeek/spool/tmp/post-terminate-worker-2023-06-23-17-38-25-1896326-crash’: Permission denied”
I can fix this temporarily by issuing ‘chown -R zeek:zeek /opt/zeek’, but the next time my workers crash, the permissions seem to have reverted to their previous state.
What could be causing this?