一开始是用chown / chmod进行修改的，但是一天后就恢复原来 的样子
发现是logrotate这个程序每天对日志进行转储的时候会修改掉，查看配置文件
/var/log/messages { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload > /dev/null endscript} 发现有个 create 640 root root 语句很像。就修改为create 770 root logging。
然后用命令logrotate -vf /etc/logrotate.d/syslog 进行测试的时候发现还是原来的样子。
后来把
sharedscripts postrotate /etc/init.d/syslog reload > /dev/null endscript
这几名注释掉就可以了，断定是syslog 程序重新加载配置文件做的修改，查看相关进程
可以看到/sbin/syslog-ng这个程序，说明SUSE下是使用这个程序来进行日志管理的。
找到它的配置文件/etc/syslog-ng/syslog-ng.conf 进行分析。里面有这么一句：
## Global options.#options { long_hostnames(off); sync(0); perm(0640); group(1001); stats(3600); }; 查看到可以设置相关的选项。详细说明如下：
OPTIONS You can specify several global options to syslog-ng in the options statement: options { opt1; opt2; ... }; Where an option can be any of the following: chain_hostnames(yes|no) Enable or disable the chained hostname format. long_hostnames(yes|no) This is a deprecated alias for chain_hostnames(). keep_hostname(yes|no) Specifies whether to trust hostname as it is included in the log message. If keep_hostname is yes and there is a hostname in the message it is not touched, otherwise it is always rewritten based on the information where the message was received from. use_dns(yes|no) Enable or disable DNS usage. syslog-ng blocks on DNS queries, so enabling DNS may lead to a Denial of Service attack. To prevent DoS, protect your syslog-ng network endpoint with firewall rules, and make sure that all hosts, which may get to syslog-ng is resolvable. use_fqdn(yes|no) Add Fully Qualified Domain Name instead of short hostname. check_hostname(yes|no) Enable or disable whether the hostname contains valid characters. bad_hostname(regex) A regexp which matches hostnames which should not be taken as such. dns_cache(yes|no) Enable or disable DNS cache usage. dns_cache_expire(n) Number of seconds while a successful lookup is cached. dns_cache_expire_failed(n) Number of seconds while a failed lookup is cached. dns_cache_size(n) Number of hostnames in the DNS cache. create_dirs(yes|no) Enable or disable directory creation for destination files. dir_owner(uid) User id. dir_group(gid) Group id. dir_perm(perm) Permission value (octal mask). owner(uid) User id for created files. group(gid) Group id for created files. perm(perm) Permission value for created files. gc_busy_threshold(n) Sets the threshold value for the garbage collector, when syslog-ng is busy. GC phase starts when the number of allocated objects reach this number. Default: 3000. gc_idle_threshold(n) Sets the threshold value for the garbage collector, when syslog-ng is idle. GC phase starts when the number of allocated objects reach this number. Default: 100. log_fifo_size(n) The number of lines fitting to the output queue. An output queue is present for all destinations. log_msg_size(n) Maximum length of message in bytes (NOTE: some syslogd implementations have a fixed limit of 1024 characters). mark(n) The number of seconds between two MARK lines. NOTE: not implemented yet. stats(n) The number of seconds between two STATS messages. sync(n) The number of lines buffered before written to file (can be overridden locally). time_reap(n) The time to wait before an idle destination file is closed. time_reopen(n) The time to wait before a died connection is reestablished. use_time_recvd(yes|no) This variable is used only for macro expansion where the meaning of the time specific macros depend on this setting, how- ever as there are separate macros for referring to the received timestamp (R_ macros) and the log message timestamp (S_), so using this value is not recommended. 可以看到里面的uid/gid/perm这三个选项正是我们要的。
总结：
1、修改配置文件/etc/syslog-ng/syslog-ng.conf
把
options { long_hostnames(off); sync(0); perm(0640); stats(3600); };
修改为
options { long_hostnames(off); sync(0); perm(0640); group(1001); stats(3600); };
说明：在groupid为组logging:!:1001: 对应的ID号
2、修改配置文件 /etc/logrotate.d/syslog
把/var/log/messages 中的行
create 640 root root
修改为
create 640 root sa_logging
3、重启后结果如下图所示：
