If you tell Apache to use CustomLog files, Apache2 will create these files on startup. And it always gives them to user root:root. How can I change this behavior?


Apache runs with

SuexecUserGroup www-data www-data

and at the same time, I use a CustomLog that pipes it output to a script. The script removes two bytes from the IP and then wirtes to the logfile. As you cannot tell Apache to omit the IP from the error.log, this piped-output is important (regarding German privacy law).

The script cannot access my custom log if this does not belong to www-data.

If I change the owner, everthing works fine.

I also know how to change the file owner when logrotate renames and re-creates the logfile.

However, if I stop the Apache process, delete the logfiles, and then restart the Apache process, new files beloging to root:root are created.

How can I tell Apache to create the new, void files as/for www-data on startup?


This sentence:

The script cannot access my custom log if this does not belong to www-data.

Is in direct contradiction with http://httpd.apache.org/docs/current/logs.html#piped:

Piped log processes are spawned by the parent Apache httpd process, and inherit the userid of that process. This means that piped log programs usually run as root. It is therefore very important to keep the programs simple and secure.

If the scenario you describe is somehow correct, you can still sidestep the issue by

  1. Ignoring the logfile name given in the config file
  2. Devising your own logfile name within the script
  3. Redirecting stdout to the file of your choosing as in (2)
  • Hmm - good point. Thanks for this advice! It seems the problem was due to the fact that the logging-script belonged to the wrong user! After giving it to root as well, everything works :) – BurninLeo Jun 14 '13 at 15:23

I ran into the same problem, yet being unable to change the script that writes the log, I could change the script that interpreted it.

More precise I changed the cron that called the interpreter script as that cron belonged to root and so before I call the interpreter (as a different user) I run:

chown www-data:www-data /var/log/apache2/*.log

Not the nicest solution and definitely not what you would want on a busy server, but on a small installation its good enough.

  • 1
    This might be a security risk. From the Apache documentation: "Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root. Do NOT give people write access to the directory the logs are stored in without being aware of the consequences; see the security tips document for details." – gpojd Jan 25 '18 at 19:08
  • @gpojd my command does not change the directory of the path but changes the files themselves. – Angelo Fuchs Jan 25 '18 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.