Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a python we application that is executed under www-data for security purpose (not under root). On of it's processes can generate application specific log file, and i want to place this file somewhere. As i notices, /var/log has root owner and drwxr-xr-x rights, so my non-root app can't write log here. What is a correct place for writing log in this case? Do i need to trash www-data home folder with logs (like ~/.myapp.log) or it's some idiomatic solution available?

share|improve this question
2  
Send the data to syslog. Syslog can write to /var/log . If you need to and if you have access, configure /etc/rsyslog.conf to write to a special file. –  Stefan Lasiewski Feb 16 '13 at 18:54

2 Answers 2

up vote 3 down vote accepted

That's what /dev/log is for. You can configure the syslog daemon to redirect the messages from your application to any file you like.

From python, this should be as easy as calling syslog.syslog.

share|improve this answer
1  
Syslog is good, but some logs may contain binary dumps in case of errors, so it's not an all-good solution O_O. –  Eye of Hell Feb 16 '13 at 19:09

Your app probably shouldn't be running as www-data. Create a new system user for it — --system option if you're using adduser — and place its files under /srv/yourapp. Then you can create a log directory for it, like /var/log/yourapp, or keep logs in /srv/yourapp/logs.

That way, your webserver runs as www-data, your app runs as yourapp, and you can start both from root. For example, using nginx with option user www-data; in its configuration, and running your app as an uWSGI (it's an application container server) app with the appropriate

uid = yourapp
gid = yourapp

in the .ini config for yourapp in /etc/uwsgi/apps-enabled/. uWSGI configuration mirrors the style of nginx configuarion. You create app profiles in /etc/uwsgi/apps-available/ and symlink them to /etc/uwsgi/apps-enabled/. Everything else should be handled by your distribution.

As far as I can tell, this is the cannonical approach. At least for Ubuntu and python webapps. And it makes general administration simpler: start-up scripts should work as intended without any special custom edits, updates shouldn't break anything... the usual benefits.

As an even more specific example, I have a MoinMoin wiki running as an uWSGI app behind nginx on Ubuntu.

From nginx site:

location = /wiki { return 301 /wiki/; }
location /wiki/ {
    gzip off;
    include uwsgi_params;
    uwsgi_param SCRIPT_NAME /wiki;
    uwsgi_modifier1 30;
    uwsgi_pass unix:/run/uwsgi/app/moin/socket;
}

From uWSGI moin.ini:

[uwsgi]
uid = moin
gid = moin

plugins = python
wsgi-file = /usr/share/moin/server/moin.wsgi
master = true

chmod-socket = 666
processes = 1

with all other settings completely default (usr/share/uwsgi/conf/default.ini for me)

MoinMoin has its own separate user

# grep moin /etc/passwd
moin:x:109:111::/srv/moin:/bin/false

and, because it was installed from the repository just like everything else (nginx, uwsgi), the remaining configuration is in /etc/moin/.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.