In article 20140806165735.GD10943@frodo.gerdesas.com, John R. Dennison jrd@gerdesas.com wrote:
On Wed, Aug 06, 2014 at 04:50:41PM +0000, Tony Mountifield wrote:
Probably rsyslog is being started before /var/log is mounted, and so it is opening files within /var/log on the root device.
rsyslog should start after local mounts are finished.
Ah, ok, thanks. I hadn't actually gone and looked...
I suspect it's selinux; /var/log should have a "var_log_t" context and I suspect it doesn't.
Be interesting to know if that fixes it for the OP.
Cheers Tony