Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wrote a PHP script to live monitor the apache access_log file. I am using the following commands;

    $path_to_tail = '/usr/bin/tail';

    $path_to_access_file = '/var/log/httpd/access_log';

error log shows this: /usr/bin/tail: cannot open `/var/log/httpd/access_log' for reading: Permission denied

I am on a RHEL Linux distro.

Changed the Others permission to Access Only and now it works, i did not change anything else

share|improve this question

closed as unclear what you're asking by BMDan, Ward, MadHatter, cole, kce Nov 20 '13 at 21:40

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

the php script can't find tail? does it have issues finding the access file? – drone.ah Feb 15 '13 at 22:52
Maybe SELinux is blocking Apache from running tail. – Tometzky Feb 15 '13 at 22:59
Do the Webserver or PHP error logs contain any errors? Also, please provide the specific error message as that may help us to diagnose the cause. – Stefan Lasiewski Feb 15 '13 at 23:30
yes the PHP cannot find the tail location given, the only error as mentioned above is from my check, now error in the apache log files. – PureGeek Feb 18 '13 at 20:40
SELinux is not enabled – PureGeek Feb 18 '13 at 20:41

You say the error is:

/usr/bin/tail: cannot open `/var/log/httpd/access_log' for reading: Permission denied

By default, the permissions for /var/log/httpd/ is that only root may read and write to that directory. Logging is handled by the parent httpd process, which runs as root. Children of this process run as user 'apache', and they cannot access the directory:

user@host:~ $ ls -ld /var/log/httpd/
drwx------. 2 root root 4096 Feb 11 11:44 /var/log/httpd/

One short term fix is to change the permissions of /var/log/httpd:

user@host:~ $ sudo chgrp apache /var/log/httpd/
user@host:~ $ sudo chmod g+rx /var/log/httpd/
user@host:~ $ sudo ls -la /var/log/httpd/
total 608
drwxr-x---. 2 root apache   4096 Feb 11 11:44 .
drwxr-xr-x. 9 root root     4096 Feb 18 02:36 ..
-rw-r--r--. 1 root root        0 Feb 11 11:44 access_log
-rw-r--r--. 1 root root   596654 Feb  7 12:04 access_log-20130211
-rw-r--r--. 1 root root      693 Feb 18 02:36 error_log
-rw-r--r--. 1 root root    11531 Feb 11 11:44 error_log-20130211

However, use caution with this. The designers of Apache chose to make /var/log/httpd/ not-readable to user Apache, probably for security reasons. Right now I cannot remember why they chose this design, but perhaps someone else could chime in.

Also see Stackoverflow: Apache access log automatically set permissions

share|improve this answer
ill try your fix right now – PureGeek Feb 20 '13 at 20:13
could i change just the access_log, the one i need to read? – PureGeek Feb 20 '13 at 20:28
changing the others permission to access makes my script work, thanks, i was going to try that but wasnt sure what security issue would arise – PureGeek Feb 20 '13 at 22:27
I'm glad it worked. Please check the Apache documentation in regards to log directories and security. For example, read – Stefan Lasiewski Feb 20 '13 at 22:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.