Magento log file permission issues

2
votes

I have a standard Magento application where actions are performed either through web (www-data) or cron scripts (executed by a cron user). By default, Magento creates log files with chmod 0640 so this gives us a problem. Whoever logs an exception/system first (www-data or cron), the other won't be able to append. So if an exception occurs on the web, the var/log/exception.log will be created with www-data as owner so cron scripts won't be able to log exceptions in the same file (cron and www-data are not in the same group but even if they would be, it wouldn't help).

Possible solutions: 1. Run cron with same www-data user (sysadmin won't budge, doesn't agree with the solution) 2. Change Mage.php to generate the log files with a more suitable chmod (even 777 maybe). Doable but this means modifying Magento core files (Mage.php) and it's not really allowed by license.

Mage class is final and I noticed there is no pre- or post- events after logging in order to possible change the chmod in a pre/post hook.

Has anybody encountered the same problem or has any advice on how to properly handle this?

2
magento

2 Answers

0
votes

Your proposed first solution sounds as the valid one to me. The cronjob should run with the www-data user. Only then you can guarantee that the file permissions match, regardless if web server or cron job.

Otherwise how can you guarantee that running the cronjob as different user a the web server will give you the same result?

Modifying Mage.php is not a right solution as you already stated. Never modify core files directly as you are going to run into problems when updating Magento - e. g. overwriting files.

0
votes

From my point of view the web user should not be same user like the shell/cronjob user. They can use the same group, but different users are more secure.

In our case web/http-user is:

  • httpd:site

and shell/cron user is:

  • prod:site

So users are different, but belong to the same group. For our case log permission 640 is too restrictive.

Its done in Mage.php

chmod($logFile, 0640);

We change them by script from 0640 to 0660 by s simple script

$command = 'find '.realpath(dirname(__FILE__)).'/var/log/ -type f -exec chmod 0660 {} +';
exec ($command);

which is executed by cron shell and wget