Pikachu2000 wrote:what permissions should it have, 644?
You could try that, but you'll probably need 666 so that the Apache process can write to it.
If you can't store it above the web root, then you could use .htaccess to secure (or entirely block) access to the file via Apache. For example:
<Files php_error.log>
Order Allow, Deny
Deny from All
</Files
would block all access to the file, though you could also setup basic HTTP authentication so that you could view the file from your browser.