Permission changing for /var/log/httpd

[m.roth at 5-cent.us]

Tom Ekberg wrote:
> I have a non-root cron job that needs to look at files in /var/log/httpd
> and transfer them (scp) to another host. That user is a member of group
> adm and I changed the ownership of /var/log/httpd to root:adm and set
> permissions to 750. This works file as the cron job can read the files.
> The problem is that once a month some process changes the ownership of
> this directory to root:root and permissions to 700. I looked at the audit
> logs and can see this happen but I have no idea what process is doing
> this. I looked at /etc/cron.monthly and there is only one entry that
> doesn't appear to cause that. Do you happen to know what process changes
> the ownership and permission of /var/log/httpd?
>
Possibly the log rotation.

      mark