Issue Failed to create subdirectories: /var/log/modsecurity/audit/apache/

[Marinuts]

Hello,
I receive this kind of error constantly, latest Plesk, CentOS:

Audit log: Failed to create subdirectories: /var/log/modsecurity/audit/apache/... (Permission denied) [hostname "xyz.com"] [uri "/error_docs/method_not_allowed.html"] [unique_id "abc"]

I already did create the subfolder by executing:
#mkdir -p /var/log/modsecurity/audit/apache/

but that still doesn't help, what user should it be owned with? with root it does not work.
No idea what is the name of web user in CentOS + Plesk.

Please advise who knows! Thanks

 

[IgorG]

Check your SELinux settings with

# getenforce

 

[Marinuts]

The only thing it says :

#getenforce

Disabled

 

[Marinuts]

I am not sure who put "resolved" tag - i still haven't received a solution and problem still persists. Would really appreciate a help here! Thank you!

 

[IgorG]

Make sure that there are correct permissions for /var and /var/log directories:

# stat /var/log/
File: '/var/log/'
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 1ch/28d Inode: 33040275 Links: 22
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)

# stat /var/
File: '/var/'
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 1ch/28d Inode: 44458484 Links: 23
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)

 

[Marinuts]

They were exactly as yours, but problem still persists:

# stat /var/log/
File: ‘/var/log/’
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 803h/2051d Inode: 51904524 Links: 18
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)

# stat /var/
File: ‘/var/’
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 803h/2051d Inode: 51904513 Links: 24
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)

 

[IgorG]

This issue may be related to this KB article Plesk shows wrong information about ModSecurity status right after Modsecurity installation
Please check it and try to apply the workaround.

 

[Marinuts]

nope, in my case it didnt affect anything, still get the same error messages in log file

 

[IgorG]

nope, in my case it didnt affect anything, still get the same error messages in log file

Please contact Plesk Support Team in this case.

 

[Marinuts]

I am paying my Plesk licence through Hetzner server company as part of their hosting package. I do not have a plesk licence code which they ask to enter in page to contact a support. I only have activation code, i do not see nothing else from Hetzner. Plesk support does not want to provide support for me and say that I must contact Hetzner. Hetzner does not provide support for Plesk either, so I am clueless who should i contact in this case?