Permission changing for /var/log/httpd

[Tom Ekberg]

I have a non-root cron job that needs to look at files in /var/log/httpd and transfer them (scp) to another host. That user is a member of group adm and I changed the ownership of /var/log/httpd to root:adm and set permissions to 750. This works file as the cron job can read the files. The problem is that once a month some process changes the ownership of this directory to root:root and permissions to 700. I looked at the audit logs and can see this happen but I have no idea what process is doing this. I looked at /etc/cron.monthly and there is only one entry that doesn't appear to cause that. Do you happen to know what process changes the ownership and permission of /var/log/httpd?

Tom Ekberg
Senior Computer Specialist, Lab Medicine
University of Washington Medical Center
1959 NE Pacific St, MS 357110
Seattle WA 98195
work: (206) 598-8544
email: tekberg at uw.edu