Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am looking for a solution to make Apache logfiles available to shared hosting in a scure manner and in real-time. I am running Apache 2.2 on Debian and have Apache configured to keep separate access- and error-logs for each virtualhost in a common directory, i.e. /var/log/apache2, the logfiles are owned by root.adm and have 640 permission.

Right now I have a hacky solution which uses a hourly cronjob to copy the logfiles of all virtualhosts to another directory which is read-only to the user a custom CGI-script runs as. This CGI-script then matches an authenticated user to the virtualhosts he/she owns and offers the logfiles of these virtualhosts for download. This is bad because I need to keep a separate table for matching authenticated users to their virtualhosts and the logs are only updated every hour.

share|improve this question

3 Answers 3

Write out the logs to a process, and have that process split out the log files as appropriate.

See the apache documentation for "Piped Logs".

share|improve this answer
    
Do you know of a tool or would I have to write that myself? rotatelogs, cronolog, and vloggler do not seem to give me the ability to set individual permisstion on the logfiles, i.e. make the logfiles for the virtualhosts of a certain user group-readable. –  Nielsb Sep 21 '09 at 18:53
    
I'm not aware of an existing program to do it. You'd have to add the logic for how it determines which lines go into which log, and that'd be different for each site. –  Joe H. Sep 23 '09 at 12:56

If you already have separate logs, why not stick them in the users home folders? You obviously don't want them in the users web root, but their home folders should not be accessibly over the web, so that should be fine. Or am I missing something?

Bart.

share|improve this answer
    
Yes, it would require root to write in users home directories which would open the door to to symlink attacks etc. –  Nielsb Sep 21 '09 at 17:24
    
Apache doesn't run as root, or at least it shouldn't. And could you explain what you mean by symlink attacks? –  Bart B Sep 22 '09 at 9:26
1  
Apache logs as root. A cronjob copying the logfiles into users home directories would require root privileges. Writing as root into directories owned by unprivileged users is inherently insecure. –  Nielsb Sep 22 '09 at 12:30

I'm pretty sure that syslog-ng does what you want. It supports splitting the output and assigning ownership to the resulting files. All this can be done in near realtime.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.