FileTest.exist(path) returning false for any file inside /var/tmp/ folder

[kashok7474]

Describe the bug

tail plugin is not able to tail any file from /var/tmp/ folder because FileTest.exist(path) returning false for any file inside /var/tmp/ folder
https://github.com/fluent/fluentd/blob/master/lib/fluent/plugin/in_tail.rb#L335

what is special about /var/tmp/ folder?

To Reproduce

use fluentd config where path point out to /var/tmp/ folder

Expected behavior

Agent should tail file from /var/tmp folder

Your Environment

- Fluentd version: Any
- TD Agent version:
- Operating system:
- Kernel version:

Your Configuration

<source>
        @type tail
        @log_level debug
        tag 687861.patternnotmatch
        #path  /var/tmp/test.log
        pos_file  /etc/test/pos/tmp2.pos
        path_key  tailed_path
        <parse>
            @type none
        </parse>
    </source>
    <match 687861.**>
      @type stdout
    </match>

Your Error Log

No error logs, fluentd just ignoring files from /var/tmp folder

Additional context

No response

[ashie]

Generally speaking it could be happen when the Fluentd process doesn't have permission to access the directory, but we can't guess the cause on your environment.

Your Environment

• Fluentd version: Any
• TD Agent version:
• Operating system:
• Kernel version:

Please describe your environment's detail.

[kashok7474]

@ashie kindly find below details:

Your Environment

Fluentd version: fluentd-1.12.3/
TD Agent version:
Operating system: Linux
Kernel version:

both /var/log and /var/tmp have root access

[root@kashokum-downloader var]# ls -lrt
total 16
drwxr-xr-x. 2 root root 6 Apr 11 2018 yp
drwxr-xr-x. 2 root root 6 Apr 11 2018 preserve
drwxr-xr-x. 2 root root 6 Apr 11 2018 opt
drwxr-xr-x. 2 root root 6 Apr 11 2018 nis
drwxr-xr-x. 2 root root 6 Apr 11 2018 local
drwxr-xr-x. 2 root root 6 Apr 11 2018 gopher
drwxr-xr-x. 2 root root 6 Apr 11 2018 games
drwxr-xr-x. 2 root root 6 Apr 11 2018 adm
drwxr-xr-x. 2 root root 6 Jun 16 2021 crash
lrwxrwxrwx. 1 root root 6 Aug 17 21:16 run -> ../run
lrwxrwxrwx. 1 root root 11 Aug 17 21:16 lock -> ../run/lock
lrwxrwxrwx. 1 root root 10 Aug 17 21:16 mail -> spool/mail
drwxr-xr-x. 3 root root 18 Aug 17 21:16 kerberos
drwxr-xr-x. 3 root root 18 Aug 17 21:17 empty
drwxr-xr-x. 2 root root 19 Aug 17 21:19 account
drwxr-xr-x. 11 root root 4096 Aug 17 21:19 spool
drwxr-xr-x. 3 root root 34 Aug 17 21:19 db
drwxr-xr-x. 3 root root 23 Oct 19 06:37 oled
drwxr-xr-x. 35 root root 4096 Oct 19 06:37 lib
drwxr-xr-x. 7 root root 74 Oct 19 06:43 cache

//
drwxr-xr-x. 11 root root 4096 Dec 11 03:47 log
drwxr-xr-x. 6 root root 4096 Dec 14 07:00 tmp
[root@kashokum-downloader var]#

[fujimotos]

The probability is that your system enables PrivateTmp. If that's the case,
your Fluentd is basically looking at /var/tmp in an alternate universe.

Check your systemd settings to be sure. Refer to the following article for
further details:

https://www.redhat.com/en/blog/new-red-hat-enterprise-linux-7-security-feature-privatetmp