Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to write a small PHP application for monitoring logs on a Debian server, including syslog logs and Apache/PHP messages. The problem here is that Apache user (www-data) has no access to /var/log directory. What would be the best way to grant an access to logs for PHP application? Let's assume that log files can be really large, like hundreds of megabytes.

I have some ideas:

  • Write a shell script that would be run via sudo and tail last 512 Kb of log into a separate file that can be read by application - that's ineffective, because of forking a new process and having to read data twice

  • Add www-data to adm group (that can read logs) - that's insecure

  • Start a PHP process via cron every minute to read logs — that's not very good, because it doesn't allow real-time monitoring. Also, this script will be started even when I don't read logs, and consume CPU time (server is in the cloud, and I'll have to pay for it)

  • Create a hardlink for all log files with lowered permissions - I guess, that won't work because logrotate could recreate log files and they'll change inode number.

  • Start a separate nginx/Apache server under privileged user that may read logs.

Maybe anyone got a better solution?

share|improve this question
add comment

3 Answers

I would recommend using rsyslogd to log directly to a mysql database which can be accessed by php. This is a supported configuration of rsyslog. I believe lenny+ for debian rsyslog is the default sys logger, so it should be just installing mysql if its not already there, configuring the security, setting up the tables, and configuring rsyslog.

http://www.rsyslog.com/doc/rsyslog_mysql.html

example:

*.*       :ommysql:database-server,database-name,database-userid,database-password

Hope this is helpful to you.

share|improve this answer
add comment

Well, though the original post is quiet some months old, I'd like to share my approach with you:

In my case I just want to monitor /var/log/mail.log. So I add the following line to /etc/sudoers:

www-data  ALL=(:adm) NOPASSWD:/bin/cat /var/log/mail.log 

This allows www-data to run the command /bin/cat /var/log/mail.log as a member of group adm.

Within PHP then I just call

$output = shell_exec('sudo -g adm cat /var/log/mail.log |/pipe/anywhere');

Hope this approach will be useful for someone...

If you feel I missed some security issues, please drop a comment

share|improve this answer
add comment

As pablo hints at - the log files don't need to be written to /var/log. They don't need to be written on the local machine - these settings can be configured out of the box. The problem with using MySQL, is that your logging system suddenly gets very complex - and what happens to log entries invoked when the dbms is down?

You could set the files to be readable by 'other' (and the directories to be executable by other) have a look at the man page for logrotate to see how to control permissions on log files.

But the process which reads the logs does not have to be run by the apache uid. Indeed, I would recommend running cron job - or prefereably a daemon - as a different user to read the logs - and extract the information you need to a common repository.

C.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.