Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wrote a PHP script to live monitor the apache access_log file. I am using the following commands;

    $path_to_tail = '/usr/bin/tail';


    $path_to_access_file = '/var/log/httpd/access_log';

error log shows this: /usr/bin/tail: cannot open `/var/log/httpd/access_log' for reading: Permission denied

I am on a RHEL Linux distro.

Changed the Others permission to Access Only and now it works, i did not change anything else

share|improve this question

closed as unclear what you're asking by BMDan, Ward, MadHatter, cole, kce Nov 20 '13 at 21:40

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
the php script can't find tail? does it have issues finding the access file? –  drone.ah Feb 15 '13 at 22:52
2  
Maybe SELinux is blocking Apache from running tail. –  Tometzky Feb 15 '13 at 22:59
2  
Do the Webserver or PHP error logs contain any errors? Also, please provide the specific error message as that may help us to diagnose the cause. –  Stefan Lasiewski Feb 15 '13 at 23:30
    
yes the PHP cannot find the tail location given, the only error as mentioned above is from my check, now error in the apache log files. –  user160246 Feb 18 '13 at 20:40
    
SELinux is not enabled –  user160246 Feb 18 '13 at 20:41
show 1 more comment

1 Answer

You say the error is:

/usr/bin/tail: cannot open `/var/log/httpd/access_log' for reading: Permission denied

By default, the permissions for /var/log/httpd/ is that only root may read and write to that directory. Logging is handled by the parent httpd process, which runs as root. Children of this process run as user 'apache', and they cannot access the directory:

user@host:~ $ ls -ld /var/log/httpd/
drwx------. 2 root root 4096 Feb 11 11:44 /var/log/httpd/

One short term fix is to change the permissions of /var/log/httpd:

user@host:~ $ sudo chgrp apache /var/log/httpd/
user@host:~ $ sudo chmod g+rx /var/log/httpd/
user@host:~ $ sudo ls -la /var/log/httpd/
total 608
drwxr-x---. 2 root apache   4096 Feb 11 11:44 .
drwxr-xr-x. 9 root root     4096 Feb 18 02:36 ..
-rw-r--r--. 1 root root        0 Feb 11 11:44 access_log
-rw-r--r--. 1 root root   596654 Feb  7 12:04 access_log-20130211
-rw-r--r--. 1 root root      693 Feb 18 02:36 error_log
-rw-r--r--. 1 root root    11531 Feb 11 11:44 error_log-20130211

However, use caution with this. The designers of Apache chose to make /var/log/httpd/ not-readable to user Apache, probably for security reasons. Right now I cannot remember why they chose this design, but perhaps someone else could chime in.

Also see Stackoverflow: Apache access log automatically set permissions

share|improve this answer
    
ill try your fix right now –  user160246 Feb 20 '13 at 20:13
    
could i change just the access_log, the one i need to read? –  user160246 Feb 20 '13 at 20:28
1  
changing the others permission to access makes my script work, thanks, i was going to try that but wasnt sure what security issue would arise –  user160246 Feb 20 '13 at 22:27
    
I'm glad it worked. Please check the Apache documentation in regards to log directories and security. For example, read httpd.apache.org/docs/2.2/logs.html#security –  Stefan Lasiewski Feb 20 '13 at 22:49
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.