rsyslog changing file owner

Solution 1:

According to this documentation page, the PrivDropToUser and PrivDropToGroup directives tell rsyslog which user/group to become after initial startup. I would hypothesize that the syslog user doesn't have adequate permissions to create files as other users, while root does.

From my reading of the above page, I think the intent is that if you want your log files owned by a lower-level user, you would put that user in ProvDropToUser; e.g. $PrivDropToUser xxxxx $PrivDropToGroup xxxxx.

You also need to ensure that the folder your log files are meant to be written in allows write access by the user from PrivDropToUser or group from PrivDropToGroup.

I found this page trying to find out how to make my web app's log files readable by my app, and thought I'd share what I've found since there's no answer. I'm no expert though.

Thank you for your question, it helped me find my own answer.