How to Change the Permissions of /var/log/messages on RHEL, AlmaLinux and Rocky Linux

Updated: 28 September 2026 · Applies to: rsyslog 8.2x and logrotate on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; notes for Ubuntu 24.04 and 26.04 and Debian 13

On AlmaLinux, Rocky Linux and RHEL, /var/log/messages is readable by root only (-rw-------). If a monitoring tool or an application running as another user must read it, give read access to a group rather than making the log readable by everyone: system logs can contain sensitive details. The old guides edited syslogd and logrotate settings from CentOS 4 to 7; on current systems the steps are below.

Option 1: let the user read the journal (often enough)

Everything in /var/log/messages also goes through the systemd journal. Members of the systemd-journal group can read all of it with journalctl, without any change to log files:

usermod -aG systemd-journal monitoruser

The user must log in again. Then journalctl -f works without root.

Option 2: make /var/log/messages readable by a group

1. Create a group and add the user:

   groupadd logreaders
   usermod -aG logreaders monitoruser

2. Tell rsyslog to create the file for that group. In /etc/rsyslog.conf, find the line that writes /var/log/messages and add two settings to it:

   *.info;mail.none;authpriv.none;cron.none action(type="omfile" file="/var/log/messages" fileGroup="logreaders" fileCreateMode="0640")

3. Check the configuration: rsyslogd -N1 must end with "End of config validation run".
4. Fix the current file, then restart rsyslog:

   chgrp logreaders /var/log/messages
   chmod 0640 /var/log/messages
   systemctl restart rsyslog

5. Check: ls -l /var/log/messages should show -rw-r----- with group logreaders.

Log rotation keeps these permissions: /etc/logrotate.conf contains the create setting, which gives each new log file the same owner, group and mode as the old one. Do not add a second logrotate entry for /var/log/messages; logrotate rejects a file that is listed twice.

Ubuntu and Debian

The main log there is /var/log/syslog, which rsyslog already creates as -rw-r----- for user syslog and group adm (the $FileGroup adm and $FileCreateMode 0640 lines in /etc/rsyslog.conf). To give a user read access, add them to the adm group: usermod -aG adm monitoruser. Debian 13 no longer installs rsyslog by default; there, use the journal as in option 1.

Common problems

• Permissions go back to 0600 after rotation: the create line in /etc/logrotate.d/rsyslog or /etc/logrotate.conf sets an explicit mode. Change that mode instead.
• The user still gets "Permission denied": group changes only apply to new logins. Log out and in, or check with id monitoruser.

Official documentation: rsyslog omfile module and logrotate manual page.