Hi, the logrotate config for radius contains a global section, which overrides the logrotate.conf defaults for all other logrotate configs sourced after radius (sssd, samba, ....). This should be avoided. Especially the "su radiusd radiusd" in this global section is the cause of failing logrotate with "permission denied", because radiusd may not read the sssd logfiles ;-)