Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a clean ubuntu-server and got apache working.

I noticed that the apache access and error logs were owned by root:

-rw-r----- 1 root adm 10531 Oct 11 00:43 access.log
-rw-r----- 1 root adm 58839 Oct 11 00:43 error.log

I was just wondering how apache actually writes out to the log if it is only writable by root.

Is it using syslog by default?


share|improve this question
up vote 3 down vote accepted

The apache server is initially started as root, it then creates separate threads running as a less privileged (usually www-data) user in order to server content. The main apache process can write to those files since it still runs as root.

share|improve this answer

Hmmmm.....from what I can tell once a file is opened, changes in the permissions do not matter. Access controls are not rechecked at each read/write done once a file is open.

Thus what I think happens is this: the top level apache server runs as root (so that it can open port 80) it opens the log files as well. When starting a server sub-process, it probably does a fork() which copies the open file descriptors to the new sub-process (i.e. the log file descriptors among a couple of others) and thus the sub-processes can write to the log files eventhough it is not root and then changes the sub-process UID to whatever is requested.

share|improve this answer
+1 for a more complete explanation. – David Pashley Oct 11 '09 at 7:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.