I have a python we application that is executed under www-data
for security purpose (not under root
). On of it's processes can generate application specific log file, and i want to place this file somewhere. As i notices, /var/log
has root
owner and drwxr-xr-x
rights, so my non-root
app can't write log here. What is a correct place for writing log in this case? Do i need to trash www-data
home folder with logs (like ~/.myapp.log
) or it's some idiomatic solution available?
2 Answers
That's what /dev/log
is for. You can configure the syslog daemon to redirect the messages from your application to any file you like.
From python, this should be as easy as calling
syslog.syslog
.
-
1Syslog is good, but some logs may contain binary dumps in case of errors, so it's not an all-good solution O_O. Feb 16, 2013 at 19:09
Your app probably shouldn't be running as www-data
. Create a new system user for it — --system
option if you're using adduser
— and place its files under /srv/yourapp
. Then you can create a log directory for it, like /var/log/yourapp
, or keep logs in /srv/yourapp/logs
.
That way, your webserver runs as www-data
, your app runs as yourapp
, and you can start both from root. For example, using nginx with option user www-data;
in its configuration, and running your app as an uWSGI (it's an application container server) app with the appropriate
uid = yourapp
gid = yourapp
in the .ini config for yourapp in /etc/uwsgi/apps-enabled/
. uWSGI configuration mirrors the style of nginx configuarion. You create app profiles in /etc/uwsgi/apps-available/
and symlink them to /etc/uwsgi/apps-enabled/
. Everything else should be handled by your distribution.
As far as I can tell, this is the cannonical approach. At least for Ubuntu and python webapps. And it makes general administration simpler: start-up scripts should work as intended without any special custom edits, updates shouldn't break anything... the usual benefits.
As an even more specific example, I have a MoinMoin wiki running as an uWSGI app behind nginx on Ubuntu.
From nginx site:
location = /wiki { return 301 /wiki/; }
location /wiki/ {
gzip off;
include uwsgi_params;
uwsgi_param SCRIPT_NAME /wiki;
uwsgi_modifier1 30;
uwsgi_pass unix:/run/uwsgi/app/moin/socket;
}
From uWSGI moin.ini:
[uwsgi]
uid = moin
gid = moin
plugins = python
wsgi-file = /usr/share/moin/server/moin.wsgi
master = true
chmod-socket = 666
processes = 1
with all other settings completely default (usr/share/uwsgi/conf/default.ini
for me)
MoinMoin has its own separate user
# grep moin /etc/passwd
moin:x:109:111::/srv/moin:/bin/false
and, because it was installed from the repository just like everything else (nginx, uwsgi), the remaining configuration is in /etc/moin/
.
/etc/rsyslog.conf
to write to a special file.