Such a shadow process tries to open the ShadowLog but seem to fail with a 'Operation not permitted' [2].
In the log fragment referenced here, the only EPERM I see is for chmod(). The return code of the chmod() I see in the logging code is deliberately ignored, so I'd be surprised if this was directly responsible for a problem. It does, however, seem a little strange.
- ToddM