production.log ownership switched to root -> app is down

Hi all,

We are facing a problem we can't resolve for now.

We have an application where sometimes production.log ownership switches from www-data to root. It crashes the application, as it is run by www-data user.

We use Phusion Passenger with Nginx on Debian and the default user is set to www-data.

We have several Rails processes that could possibly write to the log. We checked them all, they are all runned by www-data.

Maybe you can help. Do you know something we could do to "trace" the owernship switch on Linux? We are of course looking for the process that is setting the new owernship to root.

Is the timestamp on the file consistent?

Look into any cron jobs that manage logs. They will be run as root.


The first thing I'd do would be to check all cron jobs and particularly any log-rotating programs.