Linux Log permissions

Question

What is the best practice for allowing linux logs to be viewed by other users besides root?

Answer 1

Put those other users in their own group, make sure the logfiles belong to that group and make them group-readable.

Answer 2

Basically what Manni said, but if you are using log rotate, when new logs are created you will want them to have those permissions too, so look at the create directive of logrotate.

There also might be a group in place for this on your distribution, such as the adm group in Ubuntu.

Answer 3

I prefer using syslog-ng with a specific user and group doing the logging, so that if you want anyone else to be able to view the logs you add them to the "logs" group. You can also use the macro facilities in syslog-ng to rotate logs without using an external program which I find very useful Have a look at this website for some examples http://sial.org/ I find it very use- and helpful.

Good luck!

Answer 4

If the need is for the developers, who do not have shell level access on production servers to see relevant application logs, then you can try writing a simple webapp to tail the logs, so that developers can watch the logs on real time.

I have written some simple JSPs in the past to achieve this.

Doing a quick Google takes me to http://sourceforge.net/projects/logtail/ which looks better than what I came up with.

If the need is to access those log files handled by syslog, then you can configure syslogd to write the information that you wish to share to an additional log file and then set group permissions on the file.

For example, if you wish a group of users to view details about errors with the mail service, then you can add a line

mail.err                        /var/log/shared_mail.err

And then set permissions for the group to view this file.

Answer 5

FreeBSD has a group logview to which the sensitive log files belong, so any administrative users should be in that group. You might want to change the group of those files to wheel depending on your site's preferences.

Answer 6

Just allow those users to head, tail, grep and rview (!) the required files in /var/log.