When administering Linux servers with multiple users, granting controlled access to system logs like Nginx's error logs requires careful permission management. The default location /var/log/nginx/error.log typically requires root privileges, but we can implement secure alternatives.

The most maintainable solution uses Access Control Lists (ACLs) to grant specific permissions:

# Set ACL for target user (replace 'username')
sudo setfacl -m u:username:r /var/log/nginx/error.log

# Verify ACL settings
getfacl /var/log/nginx/error.log

This grants read-only access while maintaining system security. ACLs persist through log rotations when properly configured.

For environments with multiple users needing access:

# Create nginx log group
sudo groupadd nginxlog

# Add user to group
sudo usermod -a -G nginxlog username

# Change log file ownership
sudo chown :nginxlog /var/log/nginx/error.log

# Set group permissions
sudo chmod 640 /var/log/nginx/error.log

This approach scales better for teams while keeping audit trails through group membership.

For temporary access or specific use cases:

# Create symlink in user's home
sudo ln -s /var/log/nginx/error.log /home/username/nginx_error.log

# Set ownership (user must have read access to all parent directories)
sudo chown username:username /home/username/nginx_error.log

Note this still requires the original file to have appropriate read permissions.

To maintain permissions after log rotation, create a file at /etc/logrotate.d/nginx-permissions:

/var/log/nginx/*.log {
    postrotate
        /bin/chmod 640 /var/log/nginx/error.log
        /bin/chown :nginxlog /var/log/nginx/error.log
        /usr/bin/setfacl -m u:username:r /var/log/nginx/error.log
    endscript
}

Test access with:

sudo -u username cat /var/log/nginx/error.log

Common permission issues often stem from directory access - ensure the user has execute permission on all parent directories up to the log file.

When managing a multi-user Linux server, you'll often need to grant log access to team members without giving them full sudo privileges. Nginx logs stored in /var/log/nginx/ typically require root permissions, creating a security vs. accessibility dilemma.

# Create a log directory in the user's home folder
sudo mkdir /home/username/nginx_logs
sudo chown username:username /home/username/nginx_logs

# Create symlink to the actual log file
sudo ln -s /var/log/nginx/error.log /home/username/nginx_logs/error.log

# Set appropriate permissions on the original log file
sudo chmod 644 /var/log/nginx/error.log
sudo chown root:adm /var/log/nginx/error.log

Most Linux systems use the 'adm' group for log access:

sudo usermod -a -G adm username
sudo chmod 640 /var/log/nginx/error.log
sudo chown root:adm /var/log/nginx/error.log

For more precise permission management:

sudo setfacl -m u:username:r /var/log/nginx/error.log
sudo setfacl -m u:username:r /var/log/nginx/access.log

For enterprise environments, consider forwarding logs to a dedicated location:

# In /etc/rsyslog.conf
:programname, isequal, "nginx" /var/log/remote/nginx.log

# Then set permissions on the new location
sudo chmod 755 /var/log/remote
sudo chmod 644 /var/log/remote/nginx.log

• Never use 777 permissions
• Regularly audit log access permissions
• Consider log rotation impact on permissions
• For sensitive logs, implement read-only access