production.log ownership switched to root -> app is down

Hi all,

We are facing a problem we can't resolve for now.

We have an application where sometimes production.log ownership switches
from www-data to root. It crashes the application, as it is run by
www-data user.

We use Phusion Passenger with Nginx on Debian and the default user is
set to www-data.

We have several Rails processes that could possibly write to the log. We
checked them all, they are all runned by www-data.

Maybe you can help. Do you know something we could do to "trace" the
owernship switch on Linux? We are of course looking for the process that
is setting the new owernship to root.

Is the timestamp on the file consistent?

Look into any cron jobs that manage logs. They will be run as root.

Sean

The first thing I'd do would be to check all cron jobs and particularly
any log-rotating programs.