{"action":"closed","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/6073","repository_url":"https://api.github.com/repos/elastic/logstash","labels_url":"https://api.github.com/repos/elastic/logstash/issues/6073/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/6073/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/6073/events","html_url":"https://github.com/elastic/logstash/issues/6073","id":183576906,"number":6073,"title":"log4j default settings are unreasonable","user":{"login":"dcode","id":171574,"avatar_url":"https://avatars.githubusercontent.com/u/171574?v=3","gravatar_id":"","url":"https://api.github.com/users/dcode","html_url":"https://github.com/dcode","followers_url":"https://api.github.com/users/dcode/followers","following_url":"https://api.github.com/users/dcode/following{/other_user}","gists_url":"https://api.github.com/users/dcode/gists{/gist_id}","starred_url":"https://api.github.com/users/dcode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcode/subscriptions","organizations_url":"https://api.github.com/users/dcode/orgs","repos_url":"https://api.github.com/users/dcode/repos","events_url":"https://api.github.com/users/dcode/events{/privacy}","received_events_url":"https://api.github.com/users/dcode/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/logstash/labels/Pioneer%20Program","name":"Pioneer Program","color":"b60205"},{"url":"https://api.github.com/repos/elastic/logstash/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2016-10-18T02:45:32Z","updated_at":"2016-10-18T12:40:21Z","closed_at":"2016-10-18T12:40:21Z","body":"- Version: logstash 5.0.0-rc1\r\n- Operating System: CentOS 7.2\r\n- Config File (if you have sensitive info, please remove it): 100% defaults\r\n- Sample Data: N/A\r\n- Steps to Reproduce: Install the logstash-5.0.0-rc1 rpm\r\n\r\nSo, I support the move to log4j for all the reasons that I'm sure were given to motivate the change. And I'm going to try to focus on being constructive here because I just spent *hours* troubleshooting the fact that the setting for the log path changed from `path.log` to `path.log`. While mentioned in the beta1 release notes, you probably need to note this breaking syntax change that will prevent logstash from starting.\r\n\r\n/sigh\r\n\r\nOkay, so back to Log4J. After trying to figure out why logstash wasn't starting and finally figuring out the syntax error, logstash promptly told me that my log4j logs were being sent to `/usr/share/logstash/logs/`. I understand that `/usr/share/logstash` is `LS_HOME`, but this is an unreasonable and counter-intuitive location for log files. I think most sysadmins would expect this to be `/var/log/logstash` or even `/var/log`.\r\n\r\nRationale:\r\n\r\nVarious Filesystem Hierarchy Standards:\r\n- [FreeBSD](https://www.freebsd.org/doc/handbook/dirstructure.html)\r\n- [OpenBSD](http://man.openbsd.org/OpenBSD-current/man7/hier.7) (first defined for Version 7 Unix)\r\n- [Linux](http://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html)\r\n\r\nSecurity Engineering (sorry, don't have links for all of these, but you can plenty of people doing it):\r\n- Many people like a read-only `/usr` filesystem, at the minimum a non-privileged user account shouldn't be able to modify these files (i.e. `logstash` user should not be able to modify anything under `/usr/share/logstash`)\r\n- Applications like containers ideally have read-only layers of application homes. configuration data can be fed from `/etc/` and other transient data goes in `/var/` or `/run`. This reduces complexity and reduces shared container footprint.\r\n- I hope to someday (in the not so distant future) create SELinux policies to constrain Logstash. Following the \"standard\" directory layout guidelines means fewer policy exceptions which means easier for other users to use and easier maintenance.\r\n\r\nSorry for the rant, and I hope it just conveys my frustration with this surprise. I'm filing this issue in an effort to make Logstash a better product.\r\n\r\n"}}
{"actor":{"display_login":"dcode"}}