Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If you tell Apache to use CustomLog files, Apache2 will create these files on startup. And it always gives them to user root:root. How can I change this behavior?

Background

Apache runs with

SuexecUserGroup www-data www-data

and at the same time, I use a CustomLog that pipes it output to a script. The script removes two bytes from the IP and then wirtes to the logfile. As you cannot tell Apache to omit the IP from the error.log, this piped-output is important (regarding German privacy law).

The script cannot access my custom log if this does not belong to www-data.

If I change the owner, everthing works fine.

I also know how to change the file owner when logrotate renames and re-creates the logfile.

However, if I stop the Apache process, delete the logfiles, and then restart the Apache process, new files beloging to root:root are created.

How can I tell Apache to create the new, void files as/for www-data on startup?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

This sentence:

The script cannot access my custom log if this does not belong to www-data.

Is in direct contradiction with http://httpd.apache.org/docs/current/logs.html#piped:

Piped log processes are spawned by the parent Apache httpd process, and inherit the userid of that process. This means that piped log programs usually run as root. It is therefore very important to keep the programs simple and secure.

If the scenario you describe is somehow correct, you can still sidestep the issue by

  1. Ignoring the logfile name given in the config file
  2. Devising your own logfile name within the script
  3. Redirecting stdout to the file of your choosing as in (2)
share|improve this answer
    
Hmm - good point. Thanks for this advice! It seems the problem was due to the fact that the logging-script belonged to the wrong user! After giving it to root as well, everything works :) –  BurninLeo Jun 14 '13 at 15:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.