Syslog error with surilogcompress

[fmtheilig]

I am running version 2.3.100 on CentOS.
I get the following error in syslog at 17 minutes past the hour:
(CRON) ERROR chdir failed (/opt/so/conf/suricata): Permission denied
I found that the cron file for user suricata runs the script /usr/local/bin/surilogcompress every hour at the above interval. The single executable line in that script is:
find /nsm/suricata/eve.json -type f -printf '%T@\t%p\n' | sort -t $'\t' -g | head -n -1 | cut -d $'\t' -f 2 | xargs nice gzip >/dev/null 2>&1*
The above seems to be getting a list of specific json files, sorting by date, taking all but the newest file, cutting just the file name with full path, sending it to gzip (nice 10), and throwing all output to /dev/null. I'm pretty sure I got that right.
/opt/so/conf/suricata (seen in the syslog error above) is the home directory for user suricata and I verified there was nothing wrong with file and folder permissions. I even granted group suricata the same permissions as user suricata, but that did not resolve the issue.
So, I navigated to the above home directory, executed the command from the log compress script, minus the output redirect, and got the following:
gzip: compressed data not written to a terminal. Use -f to force compression.
Next, I execute the same command but with the -f option. This seemed to have worked. All but the newest .json files are now gzipped in the /nsm/suricata directory. Before I change the surilogcompress script, is my solution correct?

Thanks.

[dougburks]

I've created an issue for our team to look into this:
#7133