{"record":{"id":"51728555cca64826","repo":"fluent/fluentd","slug":"out-secondary-file-directory-should-be-writ","errorCode":null,"errorMessage":"out_secondary_file: `#{@directory}` should be writable","messagePattern":"out_secondary_file: `#(.+?)` should be writable","errorType":"validation","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin/out_secondary_file.rb","lineNumber":59,"sourceCode":"      end\n\n      if @basename.include?(\"/\")\n        raise Fluent::ConfigError, \"basename should not include `/`\"\n      end\n\n      @path_without_suffix = File.join(@directory, @basename)\n      validate_compatible_with_primary_buffer!(@path_without_suffix)\n\n      @suffix = case @compress\n                when :text\n                  \"\"\n                when :gzip\n                  \".gz\"\n                end\n\n      test_path = @path_without_suffix\n      unless Fluent::FileUtil.writable_p?(test_path)\n        raise Fluent::ConfigError, \"out_secondary_file: `#{@directory}` should be writable\"\n      end\n\n      @dir_perm = system_config.dir_permission || Fluent::DEFAULT_DIR_PERMISSION\n      @file_perm = system_config.file_permission || Fluent::DEFAULT_FILE_PERMISSION\n    end\n\n    def multi_workers_ready?\n      true\n    end\n\n    def write(chunk)\n      path_without_suffix = extract_placeholders(@path_without_suffix, chunk)\n      generate_path(path_without_suffix) do |path|\n        FileUtils.mkdir_p File.dirname(path), mode: @dir_perm\n\n        case @compress\n        when :text\n          File.open(path, \"ab\", @file_perm) {|f|","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin/out_secondary_file.rb#L41-L77","documentation":"SecondaryFileOutput#configure probes writability via Fluent::FileUtil.writable_p?(directory/basename): it walks up to the nearest existing ancestor directory of the target path and checks `File.writable?` under the Fluentd process user; if that ancestor exists but is not writable (or the target itself exists and is unwritable), this Fluent::ConfigError is raised. Note missing intermediate directories are fine as long as some ancestor (e.g. /var/log) is writable — they are mkdir_p'ed later at write time.","triggerScenarios":"Running fluentd under the `fluent` user while the nearest existing directory (often /var/log/fluent or the configured directory) is owned by root or lacks write permission; read-only mounts (immutable containers, ro volumes); the target file already exists but is owned by another user.","commonSituations":"systemd units dropping from root to User=fluent without chowning log dirs; Docker/Kubernetes readOnlyRootFilesystem without an emptyDir mount at the directory; SELinux denials on top of DAC permissions.","solutions":["Create/own the directory for the fluentd user: `install -d -o fluent -g fluent /var/log/fluent/dump`","If the file already exists, fix its owner/permissions too (`chown fluent:fluent <file>`)","On containers, mount a writable volume at the directory (emptyDir, PVC) instead of writing into the image"],"exampleFix":"# before\n# /var/log/fluent owned by root, fluentd runs as 'fluent'\nsudo mkdir -p /var/log/fluent/failed\n\n# after\nsudo mkdir -p /var/log/fluent/failed\nsudo chown -R fluent:fluent /var/log/fluent","handlingStrategy":"validation","validationCode":"# Mirror writable_p?'s logic as a pre-start check (runs as the fluentd user):\nrequire 'fileutils'\npath = File.join(directory, basename || 'dump.bin')\ndir = File.dirname(path)\ndir = File.dirname(dir) until File.exist?(dir)\nunless File.directory?(dir) && File.writable?(dir)\n  abort \"#{dir} not writable by #{Etc.getlogin rescue Process.uid}\"\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create output directories at provision time with the fluentd user as owner (install -d -o fluent -g fluent)","In containers/K8s, mount a writable volume (emptyDir/PVC) at the directory; don't write into the image or read-only roots","Run a writability probe in ExecStartPre right after config validation"],"tags":["fluentd","secondary-file","permissions","filesystem","configuration"],"backgroundTag":"directory-permission-denied","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}