Okta Privileged Access (OPA) OR Okta Advanced Server Access (ASA) Gateway service fails to start. Logs from journalctl or Service status show the following error:

Session log temporary storage directory and session log final storage location are on different devices.

• Okta Privileged Access Gateway
• Okta Advanced Server Access Gateway
• Okta Identity Engine (OIE)

The default value for SessionLogTempStorageDirectory is /tmp and for the LogDestination (if not using S3 or GCS) is /var/log/sft/sessions. In case the server has different partitions for /tmp and /var then the mentioned error can be seen.

According to the current design, the directories for the temporary and finalized session logs must be on the same device on the gateway. 

How is the session log storage location error resolved?

Move either storage location to ensure both reside on the same partition by creating a new directory and updating the gateway configuration file.

1. Create a directory under /var: 

   • sudo mkdir /var/log/sft/tmp

2. Set SessionLogTempStorageDirectory to /var/log/sft/tmp in the /etc/sft/sft-gatewayd.yaml file. 
   • Please take a look at SessionLogTempStorageDirectory for details.
3. Finally, restart the gatewayd service.

   • sudo systemctl restart sft-gatewayd

Related References

• Okta Privileged Access (OPA)
• Okta Advanced Server Access(ASA)