Bug#747076: [request-tracker-maintainers] Bug#747076: request-tracker4: rt.log file permissions

[Alex Vandiver]

On 10/04/2014 08:52 AM, Dominic Hargreaves wrote:
> Just to be clear, this was exposed as a result of the change to the
> defaults, in #712147. Unfortunately neither the bug submitter nor I
> gave any reasoning behind this choice, and (partly because of the issue
> above and partly because of the general advice given at the
> "Quit logging!"[1] Debconf session to prefer standard logging methods
> rather than logging directly to files, I am inclined to revert this
> change in time for the jessie release. This would mean that Syslog is
> used again (in fact I might make it explicit, rather than directly
> reverting the change).
> 
> I note also that at least in 2009[2], LogToFile was not recommended for
> production deployment in any case.

My only comment is that that recommendation should not be given
over-much weight.  In fact, in installs with multiple RT instances,
file-based logging may well be the only easy way to keep the instances'
logs disentangled.  The only caveat to LogToFile is that the
administrator (or package) must remember to set up logrotate for the
files RT writes, or they may grow without limit.

 - Alex


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#747076: [request-tracker-maintainers] Bug#747076: request-tracker4: rt.log file permissions

[Dominic Hargreaves]

On Mon, May 05, 2014 at 01:14:26PM +0100, Dominic Hargreaves wrote:
> The common case appears to be that /var/log/request-tracker4/rt.log
> is created owned by root, without group write permissions, so that
> the web app can't write to the file. The solution for Debian is
> probably to ensure that the file is group writable via tweaking the
> umask (/var/log/request-tracker4 is SGID so the group ownership should
> be correct); but this might have to be something that an administrator
> updates since it will vary accordingly to the particular deployemnt.

Just to be clear, this was exposed as a result of the change to the
defaults, in #712147. Unfortunately neither the bug submitter nor I
gave any reasoning behind this choice, and (partly because of the issue
above and partly because of the general advice given at the
"Quit logging!"[1] Debconf session to prefer standard logging methods
rather than logging directly to files, I am inclined to revert this
change in time for the jessie release. This would mean that Syslog is
used again (in fact I might make it explicit, rather than directly
reverting the change).

I note also that at least in 2009[2], LogToFile was not recommended for
production deployment in any case.

I will do this soon unless anyone has any contrary views.

Cheers,
Dominic.

[1] 

[2] 


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#747076: request-tracker4: rt.log file permissions

[Dominic Hargreaves]

Package: request-tracker4
Version: 4.2.3-2
Severity: important

The common case appears to be that /var/log/request-tracker4/rt.log
is created owned by root, without group write permissions, so that
the web app can't write to the file. The solution for Debian is
probably to ensure that the file is group writable via tweaking the
umask (/var/log/request-tracker4 is SGID so the group ownership should
be correct); but this might have to be something that an administrator
updates since it will vary accordingly to the particular deployemnt.

Relates also to #676322.

Dominic.


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org