LOG_STAGE_DIR: Insecure permissions and engine won't start up

This has got to be one of the weirder errors I've recently encountered. I've had weirder but not recently. ;-) We are trying to start up a new installation of release IDS-14.10 on a host and have set up the onconfig similar to onconfig files where it has been successful. One error message complains when we try to come up: ERROR: The requested log staging directory is not secure or does not exist. To display the path name here might be a confidence breach. However, looking at the onconfig of a 12.10 instance on the same host, we are specifying the same full path. (No, they're NOT both up at the same time.) Ownership is informix:informix and permissions are 770, just as they are on all other hosts in our environment. This sounds like a red-herring error message - the problem lies elsewhere. After all, we do have a running (test) server with the identical setting ad permissions and no complaints there. We got the server up by commenting out LOG_STAGE_DIR but we need to be able to use it; this server is intended as part of an RSS pair. Hey, I'm open to ideas, as usual. Thanks! Спасибо! Köszönöm, even! ------------------------------ +-----------------------------------------------------------+ | I am pleased to report that I had no problems today. | | I had only issues, opportunities, challenges and valuable | | learning experiences. | +------------------------------------------ Jacob S --------+ ------------------------------

Jacob: Check the permissions on the oninit executable. Art ------------------------------ Art S. Kagel, President and Principal Consultant ASK Database Management Corp. www.askdbmgt.com ------------------------------

Thanks, Art. However, we had already run into that and took care of it before this one cropped up. Jacob S

LOG_STAGING_DIR should have 700 permission and owned by informix:informix. If you run onstat -g cfg full LOG_STAGING_DIR, you will get below which can explain: Description: Use the LOG_STAGING_DIR configuration parameter to specify the location of log files received from the primary server when configuring delayed application of log files on RS secondary servers. The directory specified by the LOG_STAGING_DIR configuration parameter is used to store logs sent from the primary server when using the DELAY_APPLY configuration parameter to delay application of log files on an RS secondary server. Delaying the application of log files allows you to recover quickly from erroneous database modifications by restoring the data from the RS secondary server. The directory specified by the LOG_STAGING_DIR configuration parameter must be secure. The directory must be owned by user informix, must belong to group informix, and must not have public read, write, or execute permission. Please make sure no typo in the parameter name, it is LOG_STAGING_DIR, not LOG_STAG E _DIR (not sure if this is the reason why your other servers did not complain). ------------------------------ ke chen ------------------------------

Ke Chen, Thanks for the answer and possible solution. I just pointed this out to my colleague who is testing upgrades. We will certainly try this. However, I just checked our production server, running 12.10, and that file has drwxrwx--- permissions - 770, not 700. And it's running just fine. But it's possible that 14.10 requirements are more stringent. We will let you know either way on this forum. Again, thanks MUCH! ------------------------------ +-----------------------------------------------------------+ | I am pleased to report that I had no problems today. | | I had only issues, opportunities, challenges and valuable | | learning experiences. | +------------------------------------------ Jacob S --------+ ------------------------------

Hi again, Ke Chen. Although I mentioned it to a colleague, unbeknownst to be had started another upgrade on a different host without changing the permissions: Still 770. Similarly, I had forgotten your very sound advice (we're trying to upgrade half a dozen servers, c'mon already!) and upgraded another one, which came up successfully. It seems to have been in the tar-ball with those permissions when we downloaded it. It's still a mystery why I got those errors on this host but it seems not to be problem on some others. Should I see it again anywhere I definitely follow through. For now I will leave alone those that don't complain about the permissions. Mystery partially solved. THANKS!! ------------------------------ +-----------------------------------------------------------+ | I am pleased to report that I had no problems today. | | I had only issues, opportunities, challenges and valuable | | learning experiences. | +------------------------------------------ Jacob S --------+ ------------------------------

Hi, LOG_STAGING_DIR can be change in memory only - https://www.ibm.com/docs/en/informix-servers/14.10.0?topic=parameters-log-staging-dir-configuration-parameter onstat -g cfg full LOG_STAGING_DIR and get the current valueUse onsecurity with -d and the current value of LOG_STAGING_DIR to check permissions. As per the link above "The directory must be owned by user informix, must belong to group informix, and must not have public read, write, or execute permission ." Permission 770 works with 14.10 last time I checked. Regards, David. ------------------------------ David Williams Senior Database Platform Engineer Flutter London ------------------------------

Can confirm David's statement from internally, only with a catch: it's true for root installations (oninit owned by root and carrying s-bits) we'd insist on 700 instead for anything else -> Jacob might want to check oninit permissions on those systems not satisfied with 770. ------------------------------ Andreas Legner Informix Dev HCL Software ------------------------------