Hello Ben,

I was looking to your debug info : https://www.atomicorp.com/forum/viewtopic.php?f=15&t=6932&sid=23c91691756075ec7fc5cfe86a6630d1

And looks like you tried to change the file/dir permission using SecAuditLogDirMode and SecAuditLogFileMode.
However it is still being created as 755 permission. It could be related to your umask

So please try to change your umask in your /etc/profile then set above directives as 0777. Start your apache again (make sure your umask has been changed)  and let us know what happens with your file/dir permission.



On Wed, Jul 24, 2013 at 12:05 PM, Ben Empson <ben@arrayx.co.uk> wrote:

Hi Breno, sorry but I don’t understand what you mean by “You can try to set it into /etc/profile ?”


Also, I’m not clear on what you’re demonstrating with your example below. Also in my setup logs are created by the first user which tries to log, since that user creates the directory and has permissions on it. However any subsequent users are unable to log to the same directory since they do not have permissions.


Regards, Ben


From: Breno Silva [mailto:breno.silva@gmail.com]
Sent: 22 July 2013 14:08

To: mod-security-developers
Subject: Re: [Mod-security-developers] Compatibility with mod_ruid2




You can try to set it into /etc/profile ?

It works for me :


root@ubuntu:/home/brenosilva# ls -lisa /var/log/apache2/20130720/20130720-1140/20130720-114050-UerZscCoAGUAAFcXJFcAAAAe

194655 4 -rwxrwxrwx 1 www-data www-data 3342 2013-07-22 11:40 /var/log/apache2/20130722/20130722-1140/20130722-114050-UerZscCoAGUAAFcXJFcAAAAe



On Mon, Jul 22, 2013 at 12:07 AM, Ben Empson <ben@arrayx.co.uk> wrote:

Hi Breno,


I tried:

SecAuditLogDirMode 0000
SecAuditLogFileMode 0000

But on Apache restart I got the following error: “ModSecurity: Invalid value for SecAuditLogDirMode: 0000”. So I reset these 2 values to 0777.


Then I went to /var/asl/data and did


umask 0000


However I’m still getting errors in the Apache log: “ModSecurity: Audit log: Failed to create file: /var/asl/data/audit0722/20130722-0756/20130722-075623-UezXl1nIjfEAAHYWJ@oAAAAK (Permission denied)”


Note that the first website to get an error in each minute creates the audit folder and there are logs for that site. However any subsequent requests for other websites (and therefore users) get the error above since they don’t have write permissions, eg:


drwxr-xr-x  2 use11  use11   4096 Jul 22 07:55 20130722-0755/

drwxr-xr-x  2 use22  use22   4096 Jul 22 07:56 20130722-0756/


Regards, Ben


See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
mod-security-developers mailing list
ModSecurity Services from Trustwave's SpiderLabs: