When updating packages on an Ubuntu server, I got the error “Unsafe symlinks encountered in /var/log, refusing.”.
root@ip-172-31-45-33:/var# apt upgrade -y
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up rsyslog (8.32.0-1ubuntu4.2) ...
The user `syslog' is already a member of `adm'.
Unsafe symlinks encountered in /var/log, refusing.
dpkg: error processing package rsyslog (--configure):
installed rsyslog package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
E: Sub-process /usr/bin/dpkg returned an error code (1)
This is due to wrong file ownership for /var/log folder.
I found the directory “/var” was owned by user www-data
root@ip-172-31-45-33:/var# ls -l / | grep var
drwxr-xr-x 15 www-data www-data 4096 Sep 1 2021 var
To fix the error I changed ownership of /var directory to root user.
chown root:root /var
IMPORTANT: Do not use chown -R as the /var folder contains files owned by different users, if you change all file/folder ownership to root, it will mess up the system. For example /var/log/mysql need to be owned by user “mysql”, if you change it to the user “root”, MySQL will fail to start.
You may also need to check ownership of folder /var/log and files inside. You can compare it with another Ubuntu server to make sure directory/file ownerships are correct.
Back to apt