[mod-security-users] MLOGC - strange permission problem

[Arthur D. <mis...@bl...>]

Hello all,

A couple of months ago I started using the mod-security console on my
Fedora 11 machine. Installation went OK, I found that mlogc was already
installed - I just needed to configure it. 

Everything has been going quite well and the console reports all alerts
as expected.

Today I decided to have a tidy-up. I had originally configured mlogc to
write to /var/log/mlogc/ (which is where it has been quietly working
ever since) but decided that it would be more logical to have it
reporting under /var/log/httpd/mlogc/.

I changed all the relevant references in /etc/mlogc.conf and restarted
apache (subsequently even tried rebooting) but now I get this error in
my modsec_debug.log:

[04/Apr/2010:12:53:34 +0100] [www.mydomain.com/sid#1734598][rid#b7661098][/secret.html][1] Audit log: Failed to create subdirectories: /var/log/httpd/mlogc/data/20100404/20100404-1253 (Permission denied)

As far as I can tell the permissions are set identically in both the old
and the new directories:

# ll /var/log/mlogc/
total 612
drwxr-xr-x. 21 apache apache   4096 2010-04-04 11:34 data
-rw-r--r--.  1 root   root   612313 2010-04-04 11:43 mlogc-error.log
-rw-r--r--.  1 root   root       11 2010-04-04 11:43 mlogc-queue.log
-rw-r--r--.  1 root   root        0 2010-04-04 11:43 mlogc-transaction.log

# ll /var/log/httpd/mlogc/
total 12
drwxr-xr-x. 2 apache apache 4096 2010-04-04 11:36 data
-rw-r--r--. 1 apache apache 3634 2010-04-04 12:53 mlogc-error.log
-rw-r--r--. 1 apache apache   11 2010-04-04 11:52 mlogc-queue.log
-rw-r--r--. 1 apache apache    0 2010-04-04 11:52 mlogc-transaction.log

So what gives?

Why does it work in /var/log/ but not in /var/log/httpd/ ?

Thanks in advance...

Mark