Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the best practice for allowing linux logs to be viewed by other users besides root?

share|improve this question
    
What distribution? –  Kyle Brandt Jul 21 '09 at 14:47

6 Answers 6

up vote 5 down vote accepted

Put those other users in their own group, make sure the logfiles belong to that group and make them group-readable.

share|improve this answer

Basically what Manni said, but if you are using log rotate, when new logs are created you will want them to have those permissions too, so look at the create directive of logrotate.

There also might be a group in place for this on your distribution, such as the adm group in Ubuntu.

share|improve this answer

I prefer using syslog-ng with a specific user and group doing the logging, so that if you want anyone else to be able to view the logs you add them to the "logs" group. You can also use the macro facilities in syslog-ng to rotate logs without using an external program which I find very useful Have a look at this website for some examples http://novosial.org/logging/syslog-ng/index.html I find it very use- and helpful.

Good luck!

share|improve this answer
    
syslog-ng is really excellent - it's far easier to configure than syslog, and has a lot more options. Also, as well as setting default permissions/ownership for logs you can override your defaults at a per log level. –  theotherreceive Jul 21 '09 at 16:01

If the need is for the developers, who do not have shell level access on production servers to see relevant application logs, then you can try writing a simple webapp to tail the logs, so that developers can watch the logs on real time.

I have written some simple JSPs in the past to achieve this.

Doing a quick Google takes me to http://sourceforge.net/projects/logtail/ which looks better than what I came up with.

If the need is to access those log files handled by syslog, then you can configure syslogd to write the information that you wish to share to an additional log file and then set group permissions on the file.

For example, if you wish a group of users to view details about errors with the mail service, then you can add a line

mail.err                        /var/log/shared_mail.err

And then set permissions for the group to view this file.

share|improve this answer

FreeBSD has a group logview to which the sensitive log files belong, so any administrative users should be in that group. You might want to change the group of those files to wheel depending on your site's preferences.

share|improve this answer

Just allow those users to head, tail, grep and rview (!) the required files in /var/log.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.