cannot open 'file' for reading - Operation not permitted

[faramirza]

I often get random read errors on a specific vm running Centos 7.6. I'm wondering if the disk the VM running on busy failing? As it is running in the cloud I'm not seeing the backend logs on the host.

Here is a simple command that failed.

Code: Select all

[root@host1 ~]# tail -f  /var/log/messages 
tail: cannot open ‘/var/log/messages’ for reading: Operation not permitted

When I rerun it a couple of times it succeeds.

Code: Select all

[root@host1 ~]# tail -f  /var/log/messages 
tail: cannot open ‘/var/log/messages’ for reading: Operation not permitted
tail: no files remaining
[root@host1 ~]# tail -f  /var/log/messages 
Mar 19 12:17:02 eaew2t-emsabel systemd-logind: Failed to save user data /run/systemd/users/0: Operation not permitted

Note the entry in messages is also complaining about an action not permitted. Anyone with ideas to track down what is wrong?

[TrevorH]

What is the output from the command uname -a

[faramirza]

Thanks. It is

Code: Select all

Linux 3.10.0-957.5.1.el7.x86_64 #1 SMP Fri Feb 1 14:54:57 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

We identified the issue. It is due to Sophos AV on Linux using on-access scanning that we're seeing these weird behaviour. I've taken this issue up with them. Other servers using Sophos have not displayed this issue.