Repair ownership based on the actual poller account, avoid chmod 777, and confirm that both collection and graph rendering retain the access they need.
This guide approaches Cacti RRD permission errors as an operational workflow rather than a collection of random fixes. Cacti data crosses several boundaries: a scheduler starts poller.php, cmd.php or Spine queries SNMP or scripts, the poller normalizes output, RRDtool updates a data source, and the web layer renders a graph. The same blank graph can therefore have very different causes.
Scope and production assumptions
The examples target a package-managed Cacti 1.2 installation on Ubuntu 24.04 LTS. Ubuntu currently ships Cacti 1.2.26 in Noble updates; verify the repository visible to your server with apt-cache policy cacti. Paths, service accounts, PHP versions, and systemd units differ between packages and source installations, so discover them locally before copying a command.
- Use HTTPS and restrict the console to trusted networks.
- Prefer SNMPv3 authPriv; constrain SNMPv2c by source ACL when legacy devices require it.
- Keep MariaDB and RRD backups off the monitoring host and test restoration.
- Run collectors as a dedicated unprivileged account, never as root.
- Align the scheduler interval with active data-source profiles.
Fix Cacti RRD Permission and Update Failures Safely: implementation workflow
Establish a baseline
Record package versions, clock state, disk and inode use, active scheduler, poller type, data-source count, poller duration, and the last successful update. This baseline distinguishes a deployment defect from a regression and makes rollback measurable.
systemctl cat cactid
sudo grep -R "poller.php" /etc/cron.d /etc/crontab
sudo find /path/to/cacti/rra -maxdepth 1 -type f -printf '%u:%g %m %pn' | head
namei -l /path/to/cacti/rra
sudo -u POLLER_USER test -w /path/to/cacti/rra
Replace uppercase placeholders and example paths with values discovered on the target system. Commands that read configuration or logs are safe diagnostics. Commands that change ownership, database grants, RRD metadata, templates, or packages require a backup and a reviewed maintenance window.
Follow the metric end to end
- Query the source independently with the same SNMP version, credential, OID, timeout, and network path.
- Run the collector test as the scheduled poller user.
- Confirm a current
SYSTEM STATSline and inspect errors for the specific host ID. - Use
rrdtool infoandrrdtool lastupdateto verify schema and timestamp. - Enable Graph Debug Mode only after the RRD contains current values.
This order prevents a common waste of time: debugging graph CSS or RRD rendering while the device has never returned a valid number.
Common failures and their real causes
1. RRD files were created by root
Confirm the failing layer before changing configuration. Capture the exact timestamp, device, data source, service account, command, exit status, and relevant log lines. Reproduce the check with the same identity and parameters used by the poller. A successful test as root does not prove that the scheduled collector can read credentials, traverse directories, execute binaries, or update RRD files.
Correct the smallest verified cause, run one controlled collection cycle, and compare the new source value, poller log, RRD timestamp, and rendered graph. If the symptom remains, restore the previous setting and move to the next layer instead of stacking speculative changes.
2. A parent directory blocks traversal
Confirm the failing layer before changing configuration. Capture the exact timestamp, device, data source, service account, command, exit status, and relevant log lines. Reproduce the check with the same identity and parameters used by the poller. A successful test as root does not prove that the scheduled collector can read credentials, traverse directories, execute binaries, or update RRD files.
Correct the smallest verified cause, run one controlled collection cycle, and compare the new source value, poller log, RRD timestamp, and rendered graph. If the symptom remains, restore the previous setting and move to the next layer instead of stacking speculative changes.
3. SELinux or AppArmor denies access
Confirm the failing layer before changing configuration. Capture the exact timestamp, device, data source, service account, command, exit status, and relevant log lines. Reproduce the check with the same identity and parameters used by the poller. A successful test as root does not prove that the scheduled collector can read credentials, traverse directories, execute binaries, or update RRD files.
Correct the smallest verified cause, run one controlled collection cycle, and compare the new source value, poller log, RRD timestamp, and rendered graph. If the symptom remains, restore the previous setting and move to the next layer instead of stacking speculative changes.
4. A shared filesystem changes UID or mount behavior
Confirm the failing layer before changing configuration. Capture the exact timestamp, device, data source, service account, command, exit status, and relevant log lines. Reproduce the check with the same identity and parameters used by the poller. A successful test as root does not prove that the scheduled collector can read credentials, traverse directories, execute binaries, or update RRD files.
Correct the smallest verified cause, run one controlled collection cycle, and compare the new source value, poller log, RRD timestamp, and rendered graph. If the symptom remains, restore the previous setting and move to the next layer instead of stacking speculative changes.
Troubleshooting decision table
| Observation | Most useful next check | Avoid |
|---|---|---|
| No recent SYSTEM STATS | cron/cactid, service user, PHP path and lock state | Deleting RRD files |
| SNMP CLI also times out | UDP 161, ACL, credential, version and return route | Changing graph templates |
| Source is numeric but RRD shows U | DS name, type, heartbeat, step and min/max | Recreating every graph |
| RRD updates but graph fails | Graph Debug Mode and RRDtool command | Restarting pollers repeatedly |
| Manual root run works | Repeat as the actual poller account | Making the poller root |
Production best practices
Monitor the monitor from an independent system. Alert on stale SYSTEM STATS, poller duration approaching the interval, abnormal failed data sources, database connection pressure, RRD filesystem capacity, HTTP health, certificate expiration, backup age, and clock drift. Debug logging should be enabled for a bounded number of cycles and then returned to normal to avoid filling disk.
Version-control exported templates and configuration documentation. Test changes on a small device group. Do not use chmod 777, disable TLS verification, expose MariaDB publicly, or place SNMP credentials in tickets and shell history. When scale increases, remove unused data sources and repair slow devices before adding Spine threads or remote collectors.
FAQ
Should Cacti use a one-minute or five-minute interval?
Use the shortest interval the complete polling cycle can sustain with margin. A one-minute profile is harmful when devices or collectors regularly need longer.
Should I start with cmd.php or Spine?
Start with cmd.php for simplicity. Adopt Spine when measured poller duration or data-source scale requires concurrency.
Why does a graph remain empty after a fix?
RRD cannot reconstruct samples that were never collected. Wait for new valid cycles and confirm the latest RRD timestamp.
Can I run poller.php as root for testing?
Avoid it. Root-created RRD files often cause later permission failures. Test as the configured service account.
Does successful ping prove SNMP works?
No. Ping uses ICMP; SNMP normally uses UDP 161 with separate firewall and authentication rules.
When should I rebuild the poller cache?
Only after confirming stale cache is the cause and reading the CLI help for the installed version. It is not a generic graph repair.
Conclusion
Reliable Cacti RRD permission errors depends on evidence at every layer. Establish a baseline, reproduce the source query, test with the poller identity, verify the RRD update, and inspect rendering last. That method produces durable fixes while preserving historical data and keeping changes small enough to roll back.
Related Cacti guides
- Install Cacti Monitoring on Ubuntu 24.04: Complete Guide
- Configure SNMPv3 for Cacti Monitoring Securely
- Cacti cmd.php vs Spine: Configure the Right Poller
- Fix Blank and NaN Graphs in Cacti Step by Step
- Troubleshoot Cacti SNMP Timeouts on Linux and Networks
- Optimize a Slow Cacti Poller Without Losing Data
- Tune MariaDB for Cacti Pollers and Large Installations
- Back Up, Restore, and Upgrade Cacti Without Surprises
- Scale Cacti with Remote Pollers and Secure Operations
Official references: Cacti documentation, Cacti debugging guide, Spine guide, and Ubuntu Cacti packages.
3 Comments