Subject: Zabbix 7.0.29 log[] shows "Permission denied" only when log is idle after truncation

Hi Team,

I am using Zabbix Server 7.0.29 and Zabbix Agent 7.0.29 with the following active log item:

 

log[/home/vson/log/nginx_rate_limit.log,,utf-8,100,skip,,]

Issue

The item becomes Unsupported with the following error:

 

Cannot obtain information for file "/home/vson/log/nginx_rate_limit.log": [13] Permission denied

However, this happens only when there are no new log entries after the log file has been truncated.

As soon as new log entries are written to /home/vson/log/nginx_rate_limit.log, the item becomes Supported again, the error disappears from Latest Data → Information, and log monitoring continues normally.

Environment

• Zabbix Server: 7.0.29

• Zabbix Agent: 7.0.29

• Linux

• Active log item (log[])

Verification

I verified the following:

• The zabbix user can read the log file.

• Directory permissions and file permissions are correct.

• ACLs were configured and verified.

• other permissions were also granted for testing.

• SELinux is disabled.

• ProtectHome=no and ProtectSystem=no.

• Agent debug logs show:

{{process_log():SUCCEED
process_logrt():SUCCEED}}

• The history_log table receives log entries successfully.

• item_rtdata shows:

{{state = 1
error = Cannot obtain information for file "/home/vson/log/nginx_rate_limit.log": [13] Permission denied}}

Observation

The application periodically truncates the log file.

Running:

 

tail -f /home/vson/log/nginx_rate_limit.log

shows:

 

tail: /home/vson/log/nginx_rate_limit.log: file truncated

When the file is truncated and remains idle, the item becomes Unsupported with the "Permission denied" error.

When new log entries are appended, the error clears automatically and the item becomes Supported again.

Workaround

Changing the item key from:

 

log[/home/vson/log/nginx_rate_limit.log,,utf-8,100,skip,,]

to:

 

log[/home/vson/log/nginx_rate_limit.log]

appears to avoid the repeated "Permission denied" message in my environment.

Questions

• Is this expected behavior for log[] when a monitored log file is truncated and remains idle?

• Should logrt[] be used instead for applications that truncate or recreate log files?

• Has anyone experienced the same issue with Zabbix 7.0.29?

Any suggestions or guidance would be greatly appreciated.