Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When in a site apache conf file, is there a way to set the user and group for the CustomLog and ErrorLog? Right now, these 2 records create the error and access log with root:root permissions, but I would like them to be flewis:admin

CustomLog /var/log/httpd/domain.com-access.log combined
ErrorLog /var/log/httpd/domain.com-error.log

If I change the user:group of the files, when the logs rotate, the new logs are root:root

share|improve this question

1 Answer 1

You might:

chgrp admin /var/log/httpd
chmod g+s /var/log/httpd     # propagates group to new files (& g+s to new subdirs)

This may be enough. My logfiles default to rw-r----- (octal 640), so I wouldn't need more. I'd probably point the logs domain.com log into a subdirectory of httpd so I could stamp a domain.com-specific group on it.

If your webserver's defaults are more restrictive, say rw------- (octal 600), you may need find the script that starts your webserver and add "umask 027" to it (before the webserver is spawned), or see if your system uses /etc/sysconfig/httpd or the like that allows the line there. A 022 blocks only write access for group/other (allow read to everyone), and a 027 only blocks permission for users other than the owner (probably root) and your group "admin" (thus allowing read for owner and group "admin" and nothing for anyone else).

Other alternatives are to reconfigure the logs to go to syslog or to another program.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.