rsyslog Unsafe symlinks encountered in /var/log, refusing

When updating packages on an Ubuntu server, I got the error “Unsafe symlinks encountered in /var/log, refusing.”.

root@ip-172-31-45-33:/var# apt upgrade -y
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up rsyslog (8.32.0-1ubuntu4.2) ...
The user `syslog' is already a member of `adm'.
Unsafe symlinks encountered in /var/log, refusing.
dpkg: error processing package rsyslog (--configure):
 installed rsyslog package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 rsyslog
E: Sub-process /usr/bin/dpkg returned an error code (1)
root@ip-172-31-45-33:/var#

This is due to wrong file ownership for /var/log folder.

I found the directory “/var” was owned by user www-data

root@ip-172-31-45-33:/var# ls -l / | grep var
drwxr-xr-x  15 www-data www-data  4096 Sep  1  2021 var
root@ip-172-31-45-33:/var#

To fix the error I changed ownership of /var directory to root user.

chown root:root /var

IMPORTANT: Do not use chown -R as the /var folder contains files owned by different users, if you change all file/folder ownership to root, it will mess up the system. For example /var/log/mysql need to be owned by user “mysql”, if you change it to the user “root”, MySQL will fail to start.

You may also need to check ownership of folder /var/log and files inside. You can compare it with another Ubuntu server to make sure directory/file ownerships are correct.

Back to apt