2

I am trying to store the Lumen php framework logs in /var/log/apache2/ instead of its installation dir/storage/logs/ folder.

Lumen-side is fine as I can write log files in /tmp/ just fine.

Something I really cannot grasp even after a half day of research, trials and head scratching is this:

  • I'm running Ubuntu 16.04
  • logfiles stored in /var/log/apache2/ have ownership root:adm and priv -rw-r--r--
  • Apache runs as www-data user and part of www-data group only
  • I understand logrotate has the config line "create 640 root adm" so new log files are created like that
  • I believe selinux is not operating (sestatus command not found...)

So.... how comes that Apache can write its log files??

Clarifying this mystery may lead to a solution to my main problem. I really want to store the Lumen framework logs outside the Lumen installation directory as it gets replaced by continuous integration process.

I researched a lot on the topic and basics, but I could not find an answer.

Improve this question
2

Short answer: Because the Apache parent process is always started and owned by root. Therefore it can stat and write to /var/log/apache2/.

root     30089  0.0  0.4 518800 29604 ?        Ss   Jul05   0:09 /usr/sbin/apache2 -k start
www-data 13076  0.0  0.2 521180 18036 ?        S    00:05   0:00  \_ /usr/sbin/apache2 -k start
www-data 13077  0.0  0.2 521180 18036 ?        S    00:05   0:00  \_ /usr/sbin/apache2 -k start
www-data 13079  0.0  0.2 521180 18036 ?        S    00:05   0:00  \_ /usr/sbin/apache2 -k start
www-data 13080  0.0  0.2 521180 18036 ?        S    00:05   0:00  \_ /usr/sbin/apache2 -k start
www-data 13081  0.0  0.2 521180 18036 ?        S    00:05   0:00  \_ /usr/sbin/apache2 -k start
www-data 13288  0.0  0.2 521180 18036 ?        S    00:17   0:00  \_ /usr/sbin/apache2 -k start

It is probably a good idea to just avoid /var/log/apache2 and leave it for the apache2 process (only). Personally, I would create a new directory like /var/log/lumen/ (BTW: you are not forced to use the /var/log/ area for logging) owned by the given parent process you want to log. Optionally, setup a logrotate.d/ similar to apache2 to clean log folder occasionally. You could also set the group to adm via chown and in logrotate.d as mentioned to allow access to given logs by an admin group user.

Improve this answer
3
  • Thanks for the clarification and insight. But Lumen is a php framework therefore isn't it interpreted and executed by Apache? Therefore shouldn't Apache being allowed to log in its logging directory? It would be ok for me to log into /var/log/lumen/, but what would be the proper owner then? – Ascanio Orlandini Jul 14 '19 at 6:38
  • 1
    ok, I understand now that the lumen framework is run by a child process of apache running as www-data user. Creating the dir /var/www/lumen/ owned by www-data:adm allows creating the log files inside as I wanted! Then I configured logrotate to take care of that dir also. Thanks! – Ascanio Orlandini Jul 14 '19 at 11:34
  • Good deal. TBH, I didn't even lookup what Lumen was before I wrote that. I see now it's a PHP framework and uses 'Monolog" for it's logging configuration. And yes, PHP should "execute" via the Apache PHP module. BUT, specific PHP execution logging is app dependent, though. (Defaults to the apache2/php.ini error_log value.) (See 'error_log') -> php.net/manual/en/function.error-log.php - Lumen/Monolog probably just manipulates that core directive. – bshea Jul 14 '19 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.