diff --git a/src/apps.js b/src/apps.js
index bca61124e..d6b40d746 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -2108,7 +2108,7 @@ async function getLogs(app, options) {
     const appId = app.id;
 
     const logPaths = await getLogPaths(app);
-    const cp = logs.tail(logPaths, { lines: options.lines, follow: options.follow });
+    const cp = logs.tail(logPaths, { lines: options.lines, follow: options.follow, sudo: true }); // need sudo access for paths inside app container (manifest.logPaths)
 
     const logStream = new logs.LogStream({ format: options.format || 'json', source: appId });
     logStream.on('close', () => cp.terminate()); // the caller has to call destroy() on logStream. destroy() of Transform emits 'close'
diff --git a/src/logs.js b/src/logs.js
index 33a579dde..5276fd05f 100644
--- a/src/logs.js
+++ b/src/logs.js
@@ -57,10 +57,17 @@ function tail(filePaths, options) {
     assert.strictEqual(typeof options, 'object');
 
     const lines = options.lines === -1 ? '+1' : options.lines;
-    const args = [ LOGTAIL_CMD, '--lines=' + lines ];
+    const args = options.sudo ? [ LOGTAIL_CMD ] : [];
+    args.push(`--lines=${lines}`);
     if (options.follow) args.push('--follow');
 
-    return shell.sudo('tail', args.concat(filePaths), { streamStdout: true }, () => {});
+    if (options.sudo) {
+        return shell.sudo('tail', args.concat(filePaths), { streamStdout: true }, () => {});
+    } else {
+        const cp = spawn('/usr/bin/tail', args.concat(filePaths));
+        cp.terminate = () => cp.kill('SIGKILL');
+        return cp;
+    }
 }
 
 function journalctl(unit, options) {
@@ -76,7 +83,9 @@ function journalctl(unit, options) {
 
     if (options.follow) args.push('--follow');
 
-    return spawn('journalctl', args);
+    const cp = spawn('journalctl', args);
+    cp.terminate = () => cp.kill('SIGKILL');
+    return cp;
 }
 
 exports = module.exports = {
diff --git a/src/shell.js b/src/shell.js
index c1a1ac0cd..7f5288cda 100644
--- a/src/shell.js
+++ b/src/shell.js
@@ -20,7 +20,7 @@ exports = module.exports = {
 
 const SUDO = '/usr/bin/sudo';
 
-// default encoding utf8, no shell, separate args, wait for process to finish
+// default encoding utf8, no shell, handles input, separate args, wait for process to finish
 async function execArgs(tag, file, args, options) {
     assert.strictEqual(typeof tag, 'string');
     assert.strictEqual(typeof file, 'string');