{"action":"opened","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/1397","labels_url":"https://api.github.com/repos/systemd/systemd/issues/1397/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/1397/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/1397/events","html_url":"https://github.com/systemd/systemd/issues/1397","id":108564215,"number":1397,"title":"Bug: users from the group `systemd-journal` couldn't read some journal files","user":{"login":"evverx","id":10195800,"avatar_url":"https://avatars.githubusercontent.com/u/10195800?v=3","gravatar_id":"","url":"https://api.github.com/users/evverx","html_url":"https://github.com/evverx","followers_url":"https://api.github.com/users/evverx/followers","following_url":"https://api.github.com/users/evverx/following{/other_user}","gists_url":"https://api.github.com/users/evverx/gists{/gist_id}","starred_url":"https://api.github.com/users/evverx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evverx/subscriptions","organizations_url":"https://api.github.com/users/evverx/orgs","repos_url":"https://api.github.com/users/evverx/repos","events_url":"https://api.github.com/users/evverx/events{/privacy}","received_events_url":"https://api.github.com/users/evverx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-27T22:19:22Z","updated_at":"2015-09-27T22:19:22Z","closed_at":null,"body":"[`man systemd-journald`](http://www.freedesktop.org/software/systemd/man/systemd-journald.service.html#Access%20Control) says:\r\n\r\n> Journal files are, by default, owned and readable by the \"systemd-journal\" system group but are not writable. Adding a user to this group thus enables her/him to read the journal files.\r\n\r\n[`man journald.conf`](http://www.freedesktop.org/software/systemd/man/journald.conf.d.html#Storage=) says:\r\n\r\n> Storage=\r\n> ... If \"persistent\", data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy **(which is created if needed)**\r\n\r\n**How to reproduce**:\r\n\r\n* Set [`Storage`](http://www.freedesktop.org/software/systemd/man/journald.conf.d.html#Storage=) to `persistent`:\r\n\r\n    ```sh\r\n    root# mkdir -p /etc/systemd/journald.conf.d\r\n    root# printf \"[Journal]\\nStorage=persistent\\n\" >/etc/systemd/journald.conf.d/99-Storage-Persistent.conf\r\n    ```\r\n\r\n* Add the user `logs-pusher` to the group `systemd-journal`:\r\n\r\n    ```sh\r\n     root# adduser --ingroup systemd-journal --disabled-password --gecos '' --quiet logs-pusher\r\n    ```\r\n\r\n* Remove the directory `/var/log/journal`:\r\n\r\n    `root# rm -rf /var/log/journal`\r\n\r\n* Reboot:\r\n\r\n    `root# systemctl reboot`\r\n\r\n* Try `journalctl` as the user `logs-pusher`:\r\n\r\n    ```sh\r\n    root# sudo -u logs-pusher journalctl --system\r\n    No journal files were opened due to insufficient permissions.\r\n\r\n   root# tree -ugp /var/log/journal/\r\n    /var/log/journal/\r\n    └── [drwxr-sr-x root     systemd-journal]  0a04d638e3064b74b445643cd046262d\r\n        ├── [-rw-r-x--- root     root    ]  system.journal\r\n        └── [-rw-r-x--- root     systemd-journal]  user-1000.journal\r\n    ```\r\n\r\n**Possible solution**:\r\n\r\nSomething like `Z /var/log/journal/%m ~7777 root systemd-journal - -` in the file [`tmpfiles.d/systemd.conf`](https://github.com/systemd/systemd/blob/master/tmpfiles.d/systemd.conf.m4)\r\n"}}