Coming back to this because of PUP-8634. Since the log file is created by the agent process, which runs as a privileged user, and the log file may contain sensitive information, we should not try to change owner/group to a less privileged account (puppet), and we should set a restrictive file mode (0600).