ModSecurity: Audit log: Failed to create subdirectories: /var/asl/data/audit/nobody/

Noticed the below error in apache error log

[Wed Jan 07 11:19:54.786501 2015] [:error] [pid 24001:tid 140170514261760] [client 1.2.3.4] ModSecurity: Audit log: Failed to create subdirectories: /var/asl/data/audit/nobody/20150107/20150107-1119 (Permission denied) [hostname “test.com”] [uri “/index.php”] [unique_id “VKyJukgiKxYAAF3BqvIAAABA”]

Fix:

mkdir /var/asl /var/asl/data /var/asl/data/audit /var/asl/data/msa /var/asl/data/security

confirm which user apache uses to run     ps -ef | grep http

Normally it will be nobody.

chown -R nobody.nobody /var/asl/data/

/etc/init.d/httpd restart

Comments: 2

  1. Nik Rivas-Barnao March 26, 2016 at 10:57 AM Reply

    Nice simple solution that works on a server running cpanel with nginx reverse proxy, cheers!

    • March 29, 2016 at 6:51 PM Reply

      Glad that this worked for you.

Leave a Reply

Your email address will not be published. Required fields are marked *