When using cgrulesengd it would create a logfile at /var/log/cgred with the permission wide open (0666).