native.log permission errors (SP 2.5)

[Matthew Vernon]

Hi,

We've been seeing some somewhat confusing errors from our Shibboleth
SPs, and am not quite sure how best to resolve them. This is running the
2.5 SP (Apache/ SLES11), although the config has been being used over a
number of previous versions.

We're seeing lots of errors in native_warn.log:

2015-01-16 18:51:42 CRIT XMLTooling.Logging : error in file permissions
or logging configuration: exception creating appender: failed to open
log file (/var/log/apache2/native.log)

and also in native.log itself:

2015-01-16 09:33:08 CRIT XMLTooling.Logging : error in file permissions
or logging configuration: exception creating appender: failed to open
log file (/var/log/apache2/native.log)
2015-01-16 09:33:08 CRIT Shibboleth.Config : failed to load new logging
configuration from (native.logger)

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogging
mentions a "permission issue noted above" but it's not clear exactly
what that's referring to

native.log and native_warn.log are both root:root and only writeable by
root.

native.logger defines the two log files thus:

log4j.appender.native_log=org.apache.log4j.RollingFileAppender
log4j.appender.native_log.fileName=/var/log/apache2/native.log
log4j.appender.native_log.maxFileSize=1000000
log4j.appender.native_log.maxBackupIndex=10
log4j.appender.native_log.layout=org.apache.log4j.PatternLayout
log4j.appender.native_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S}
%p %c %x: %m%n

log4j.appender.warn_log=org.apache.log4j.RollingFileAppender
log4j.appender.warn_log.fileName=/var/log/apache2/native_warn.log
log4j.appender.warn_log.maxFileSize=1000000
log4j.appender.warn_log.maxBackupIndex=10
log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout
log4j.appender.warn_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S}
%p %c %x: %m%n
log4j.appender.warn_log.threshold=WARN

And shibboleth2.xml has:

    <!-- The InProcess section conrains settings affecting web server
modules/filters. -->
    <InProcess logger="native.logger">
        <ISAPI normalizeRequest="true">
            <Site id="1" name="FIX-ME2"/>
        </ISAPI>
    </InProcess>

The upgrade notes suggest that with 2.5 perhaps the above logger
configuration (and its associated OutOfProcess element) could be
discarded *or* file permissions changed, but I'm a bit confused because
clearly shib is managing to log to both the log files mentioned in the
native.logger configuration file, despite complaining about permissions.

Could you advise on the correct approach, please?

Thanks,

Matthew