Where non-root web app should write it's log under ubuntu?

Question

I have a python we application that is executed under www-data for security purpose (not under root). On of it's processes can generate application specific log file, and i want to place this file somewhere. As i notices, /var/log has root owner and drwxr-xr-x rights, so my non-root app can't write log here. What is a correct place for writing log in this case? Do i need to trash www-data home folder with logs (like ~/.myapp.log) or it's some idiomatic solution available?

Answer 1

That's what /dev/log is for. You can configure the syslog daemon to redirect the messages from your application to any file you like.

From python, this should be as easy as calling syslog.syslog.

Answer 2

Your app probably shouldn't be running as www-data. Create a new system user for it — --system option if you're using adduser — and place its files under /srv/yourapp. Then you can create a log directory for it, like /var/log/yourapp, or keep logs in /srv/yourapp/logs.

That way, your webserver runs as www-data, your app runs as yourapp, and you can start both from root. For example, using nginx with option user www-data; in its configuration, and running your app as an uWSGI (it's an application container server) app with the appropriate

uid = yourapp
gid = yourapp

in the .ini config for yourapp in /etc/uwsgi/apps-enabled/. uWSGI configuration mirrors the style of nginx configuarion. You create app profiles in /etc/uwsgi/apps-available/ and symlink them to /etc/uwsgi/apps-enabled/. Everything else should be handled by your distribution.

As far as I can tell, this is the cannonical approach. At least for Ubuntu and python webapps. And it makes general administration simpler: start-up scripts should work as intended without any special custom edits, updates shouldn't break anything... the usual benefits.

As an even more specific example, I have a MoinMoin wiki running as an uWSGI app behind nginx on Ubuntu.

From nginx site:

location = /wiki { return 301 /wiki/; }
location /wiki/ {
    gzip off;
    include uwsgi_params;
    uwsgi_param SCRIPT_NAME /wiki;
    uwsgi_modifier1 30;
    uwsgi_pass unix:/run/uwsgi/app/moin/socket;
}

From uWSGI moin.ini:

[uwsgi]
uid = moin
gid = moin

plugins = python
wsgi-file = /usr/share/moin/server/moin.wsgi
master = true

chmod-socket = 666
processes = 1

with all other settings completely default (usr/share/uwsgi/conf/default.ini for me)

MoinMoin has its own separate user

# grep moin /etc/passwd
moin:x:109:111::/srv/moin:/bin/false

and, because it was installed from the repository just like everything else (nginx, uwsgi), the remaining configuration is in /etc/moin/.