Make php-fpm log as root:adm

loggingphp-fpm

I want to make sure members of the adm groups can read all logs, and the php-fpm process makes an exception as it logs php5-fpm.log under root:root and u=r+w

I can't find a way to achieve this. I've considered using syslog.facility directives but I'd rather keep a dedicated log file.

Best Answer

You should read more carefully the manual on PHP FPM Configuration php-fpm.conf directives:

  • The syslog.facility directive only controls the facility type and is by default set to daemon. This doesn't affect the location. Non-normative syslog facilities are defined in RFC 5424, 6.2.1. As you can see, facilities 16-23 are for local use and you could dedicate one for PHP FPM.
  • The correct directive for sending log to syslogd instead of local file is error_log syslog, while the default value is #INSTALL_PREFIX#/log/php-fpm.log.
  • Another important directive here is syslog.ident php-fpm (that is the default value).

On configuration level there's nothing about file permissions. You'd have to get on the source code level to figure out how it's actually done. Some advice changing log file permissions on an init script.

One Logrotate to rule them all

File permissions can be controlled in logrotate configuration, which also has create directive.

/var/log/php-fpm.log {
    create 0640 root adm
}

Syslogd & dedicated facility

Using the Syslogd enables configuring all file locations on the same syslog.conf. It is still possible to configure syslogd to use separate log file for PHP FPM by the dedicated facility, e.g. local4:

# /etc/syslog.conf

local4.*    /var/log/php-fpm.log

Rsyslog filters

If you're using rsyslogd, you can filter the PHP-FPM's syslog.ident prepended to every message:

# /etc/rsyslog.conf

:syslogtag, isequal, "php-fpm"    /var/log/php-fpm.log
:syslogtag, isequal, "php-fpm"    ~

With rsyslogd, file permissions are also set in the rsyslog.conf:

# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
Related Topic