I'm wondering what the best practice is for viewing the logs/files of a service named webapp. This webapp operates under its own user and group, and so all of the files it needs are owned by webapp:webapp.

If I ssh into my server, I need to sudo if I want to tail the logs (since they are not world-readable), and I want to avoid this.

Should I change the group on these log files to wheel or something else I'm a part of, or should I just grant my user membership in the webapp group? Or something else?


There are a lot of ways. You already did some examples like being part of the group "webapp". Another way would be to use ACL to grand access for your user to the directory and files.


Well, you answered your own question.

It really depends on your usage case. If there are no side affects to adding user to webapp group (like group-writable files or sensitive files with passwords that user should not be able to access, etc.), that would be my default choice - you do not risk app (or related scripts like cron, logrotate etc) breaking because of changed group, and you can easily see what user has access to what.

  • I was curious if best practices exist — thanks for the answer! – NReilingh Aug 17 '16 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.