I tied to add simple active log check – logrt[/var/log/syslog] and got this error in agent log:
active check "logrt[/var/log/syslog]" is not supported: Cannot open file "/var/log/anaconda.syslog": [13] Permission denied
after I granted acess to /var/log/anaconda.syslog this error disappeared.
Why do agent need access to any other files than requested one?