Permissions of spool directory keeps changing

I’m having an issue whereby my workers are crashing due to interface issues (but that’s another story). The problem I’d like to discuss here is that when I attempt to re-start the workers, I run into a permissions issue:

“Error: error running post-terminate for worker-4: mv: cannot move ‘/opt/zeek/spool/worker-4’ to ‘/opt/zeek/spool/tmp/post-terminate-worker-2023-06-23-17-38-25-1896326-crash’: Permission denied”

I can fix this temporarily by issuing ‘chown -R zeek:zeek /opt/zeek’, but the next time my workers crash, the permissions seem to have reverted to their previous state.

What could be causing this?

Hello, what operating system are you using, and what version of Zeek?

This sounds like an OS issue but I’ve never encountered it before.

Sincerely,

Richard

Hello, I’m running version 5.2.2 on Ubuntu 22.04 Server.

1 Like