# newsyslog: can't fopen /var/log/pflog for reading: No such file or directory



## ProServ (Jul 20, 2021)

Hi, have been getting nightly root email about:

```
newsyslog: can't fopen /var/log/pflog for reading: No such file or directory
```
However the file definitely exists:

```
# ll /var/log/pflog
-rw-------  1 root  wheel  540 Jul 20 12:21 /var/log/pflog

# file /var/log/pflog
/var/log/pflog: pcap capture file, microsecond ts (little-endian) - version 2.4 (OpenBSD PFLOG, capture length 116)
```
Any suggestions to get this working?'
Thanks.


----------



## SirDice (Jul 20, 2021)

What are the permissions on /var/ and /var/log?


----------



## ProServ (Jul 21, 2021)

SirDice said:


> What are the permissions on /var/ and /var/log?


Hi SirDice,

```
drwxr-xr-x  29 root  wheel  1024 Jun 21 04:57 /var
drwxr-xr-x  6 root  wheel  3072 Jul 21 02:25 /var/log
-rw-------  1 root  wheel  1972 Jul 21 02:28 /var/log/pflog
```
Thanks SirDice!


----------



## Tieks (Jul 21, 2021)

If newsyslog is indeed running as root, it should be able to open /var/log/pflog with these permissions. Except when `pflogd` opened that file exclusively for writing. What does your entry for pflogd in /etc/newsyslog.conf look like?


----------



## ProServ (Jul 21, 2021)

Tieks said:


> If newsyslog is indeed running as root, it should be able to open /var/log/pflog with these permissions. Except when `pflogd` opened that file exclusively for writing. What does your entry for pflogd in /etc/newsyslog.conf look like?


There is no entry for pflogd.


----------



## ProServ (Jul 21, 2021)

After looking at /etc/newsyslog not seeing any entry for pflog, added it :

```
/var/log/pflog      600  30    *    @T00 JB    /var/run/pflogd.pid
```
and ran: # newsyslog -vCF 
Hopefully it's now fixed.


----------



## SirDice (Jul 21, 2021)

It's been split off to /etc/newsyslog.conf.d/pf.conf:

```
# $FreeBSD$
/var/log/pflog                          600  3     1000 *     JB    /var/run/pflogd.pid
```

The last two lines in /etc/newsyslog.conf load extra configuration files from /etc/newsyslog.conf.d and /usr/local/etc/newsyslog.conf.d:

```
<include> /etc/newsyslog.conf.d/[!.]*.conf
<include> /usr/local/etc/newsyslog.conf.d/[!.]*.conf
```


----------



## ProServ (Jul 21, 2021)

/etc/newsyslog.conf.d has pf.conf and pf.conf has 
/var/log/pflog                          600  3     1000 *     JB    /var/run/pflogd.pid

I presume the above has been for some time as I did not add that line. But it doesn't work as it says no such file..

So what else is causing it to say:
newsyslog: can't fopen /var/log/pflog for reading: No such file or directory

because that file IS there.

I did add to /etc/newsyslog.conf  yesterday,
/var/log/pflog                          600  30    *    @T00 JB    /var/run/pflogd.pid

The mail containing the error of no such file was from July 20. In today's email I did not see that error.

Thanks.


----------

