getting eventlog - try www-data as thats the most likely location