# Production.log ownership switched to root -\> app is down

**URL:** <https://www.ruby-forum.com/t/production-log-ownership-switched-to-root-app-is-down/192340>\
**Category:** Rails\
**Created:** [July 28, 2010, 4:04pm UTC](https://www.ruby-forum.com/t/production-log-ownership-switched-to-root-app-is-down/192340 "2010-07-28T16:04:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![teddio](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b3f665/32.png) [@teddio](https://www.ruby-forum.com/u/teddio)\
**Post date:** [July 28, 2010, 4:04pm UTC](https://www.ruby-forum.com/t/production-log-ownership-switched-to-root-app-is-down/192340/1 "2010-07-28T16:04:47Z")

</div>

Hi all,

We are facing a problem we can’t resolve for now.

We have an application where sometimes production.log ownership switches  
from www-data to root. It crashes the application, as it is run by  
www-data user.

We use Phusion Passenger with Nginx on Debian and the default user is  
set to www-data.

We have several Rails processes that could possibly write to the log. We  
checked them all, they are all runned by www-data.

Maybe you can help. Do you know something we could do to “trace” the  
owernship switch on Linux? We are of course looking for the process that  
is setting the new owernship to root.

---

<div class="post-metadata">

**Author:** ![teddio](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b3f665/32.png) [@teddio](https://www.ruby-forum.com/u/teddio)\
**Post date:** [July 28, 2010, 4:45pm UTC](https://www.ruby-forum.com/t/production-log-ownership-switched-to-root-app-is-down/192340/2 "2010-07-28T16:45:18Z")

</div>

On Jul 28, 9:04 am, Michael H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Maybe you can help. Do you know something we could do to “trace” the  
> owernship switch on Linux? We are of course looking for the process that  
> is setting the new owernship to root.

Is the timestamp on the file consistent?

Look into any cron jobs that manage logs. They will be run as root.

Sean

---

<div class="post-metadata">

**Author:** ![teddio](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b3f665/32.png) [@teddio](https://www.ruby-forum.com/u/teddio)\
**Post date:** [July 28, 2010, 4:54pm UTC](https://www.ruby-forum.com/t/production-log-ownership-switched-to-root-app-is-down/192340/3 "2010-07-28T16:54:05Z")

</div>

On Wed, Jul 28, 2010 at 7:04 AM, Michael H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> We have an application where sometimes production.log ownership switches  
> from www-data to root.

> We are of course looking for the process that is setting the new  
> owernship to root.

The first thing I’d do would be to check all cron jobs and particularly  
any log-rotating programs.

–  
Hassan S. ------------------------ removed\_email\_address@domain.invalid  
twitter: @hassan