What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
If Apache stops with AH00015: Unable to open logs, (13) Permission denied, or a similar message, fix the log path and its permissions before changing unrelated web-server settings. Apache opens its configured error and access logs during startup; failure to traverse a parent directory, create the file, follow a symlink, or satisfy SELinux/AppArmor policy can abort startup before a normal error log exists.
The reliable repair is to identify the active configuration, resolve the effective ErrorLog and CustomLog destinations, inspect every directory in each path, restore the intended owner and least-privilege modes, test the configuration, and then verify a real service start and fresh log entry.
What the error means
Apache httpd initializes logging before it launches its request-handling child processes under a less-privileged account. At that point it must be able to search every directory in the path, open an existing file or create a missing one, and access the target if the path contains a symbolic link. If any of those operations fails, startup can terminate immediately.
That explains an apparently contradictory symptom: Apache reports that it cannot open logs, yet the expected error log contains nothing. The failure happened before the daemon could write its normal diagnostics. The service manager, terminal, or system journal is therefore the first place to collect evidence.
ErrorLog determines where Apache writes its error log. CustomLog controls access-log destinations. A relative filename is resolved relative to Apache’s effective ServerRoot, not necessarily to a distribution’s familiar default such as /var/log/apache2 or /var/log/httpd. Virtual-host files can override or add log paths, so checking only the global configuration can miss the file that actually blocks startup.
Capture the exact startup failure first
Do not begin by recursively changing permissions. Preserve the precise message and path; it tells you which branch of the diagnosis to follow.
Start from the service manager
On a systemd host, inspect the unit status and recent journal entries. Replace apache2 with the service name used by your distribution, commonly httpd or apache2.
sudo systemctl status apache2 --no-pager -l
sudo journalctl -u apache2 -b --no-pager
If the unit is named httpd:
sudo systemctl status httpd --no-pager -l
sudo journalctl -u httpd -b --no-pager
Look for AH00015, Unable to open logs, (13) Permission denied, No such file or directory, or a path-specific message. A missing directory and an access denial require different repairs, so retain the complete line.
Capture foreground output when the journal is incomplete
Run the syntax check or a controlled foreground start with the same binary and configuration selected by your distribution. A foreground start should be used carefully on a production host because it can conflict with an already-running instance; use it after stopping the service or in a maintenance window.
sudo apachectl -t
sudo httpd -t
Use the command that exists on the host and points to the production configuration. Apache reports fatal startup problems to the console or the configured error log, so console output is valuable when the log cannot yet be opened.
Find the active configuration and every log destination
Before changing a file, establish which configuration Apache is actually loading. Package layouts, alternate instances, containers, and manually installed builds can use different binaries and ServerRoot values.
Check the loaded configuration
Use the distribution’s Apache control command to display build and configuration details where supported:
apachectl -V
httpd -V
Look for the compiled-in SERVER_CONFIG_FILE and HTTPD_ROOT. Those values identify the default configuration file and root, but an init system or command-line option can select another file. Confirm the service unit’s ExecStart line and any included environment file if the output does not match the running service.
Search global and virtual-host configuration
Inspect the main file and every included fragment for ErrorLog and CustomLog. On systems with a sites-enabled or conf.d arrangement, include each enabled virtual host in the review.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorssudo grep -RInE '^[[:space:]]*(ErrorLog|CustomLog)[[:space:]]+' /etc/apache2 /etc/httpd 2>/dev/null
Adjust the directories to match the configuration root discovered on your host. Do not assume that a commented example is active; verify the directive is in an enabled file and applies to the virtual host being loaded.
Resolve relative paths correctly
If a directive says, for example, ErrorLog logs/error_log, resolve it against the active ServerRoot. The effective destination may therefore be /opt/apache/logs/error_log, not a system package directory. Treat the path printed in the startup error as authoritative when it is present, then confirm it against the configuration.
Inspect the complete path, not just the log file
Unix permission checks are cumulative. Apache needs search (x) permission on every parent directory, read/write permission appropriate to the operation on the file, and permission to traverse a symlink’s target path. A correctly owned final file is still unusable if one parent directory denies traversal.
Use namei to expose each path component
sudo namei -l /path/to/error_log
namei -l prints ownership and mode for each component, making a hidden denial such as /var/log/private without search permission visible. Run it for every configured error and access-log path.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck the file and each directory directly
sudo stat /path/to/error_log
sudo ls -ld /path /path/to /path/to/error_log
If the file does not exist, stat will report that fact; inspect the containing directory instead. Check whether a path component is a symbolic link:
sudo ls -ld /path/to/error_log
sudo readlink -f /path/to/error_log
The resolved target must exist or be creatable, and Apache must be able to traverse every directory on the target path. A symlink that points into a protected or unavailable mount can produce the same startup failure as a bad mode on the visible filename.
Interpret the relevant permission bits
- Directory search: the account starting Apache needs
xon every parent directory. Without it, the process cannot reach the log even if the file itself is writable. - Directory write: required when Apache must create a missing log file or replace one during rotation. A pre-created file can work with file write permission while the directory remains non-writable, but rotation tools may then fail.
- File write: required for appending log entries. Read permission is not generally what permits appending.
- Ownership and group: must match the account and group used by the service and by the rotation mechanism. Do not infer these from another host.
- Special mounts: read-only filesystems, unavailable network mounts, and mount options can prevent creation even when mode bits look permissive.
Identify the account Apache uses at startup
Apache commonly starts with administrative privileges so it can bind to a privileged port, opens its logs, and then runs worker processes under configured User and Group identities. The account that opens a log during the privileged startup phase may differ from the account that later writes requests, depending on the logging setup and platform.
Read the active User and Group directives and inspect the service unit. Also check the process table when an older instance is still running:
Recommended Free Tools
ps -eo user,group,pid,comm,args | grep -E '[a]pache2|[h]ttpd'
Restore the package or administrator’s intended ownership rather than selecting a universally writable owner. If a distribution supplies a dedicated log group or rotation helper, preserve that arrangement. The correct values vary by operating system, package, and local hardening, so copy them from a known-good sibling log or the package’s documented defaults on that host.
Repair a missing directory or file safely
Make the smallest change that satisfies the configured path. First back up the relevant configuration and record current metadata:
sudo cp -a /path/to/config /path/to/config.backup
sudo namei -l /path/to/error_log
Create only what is missing
If the parent directory is absent, create that directory rather than an unrelated global log tree:
sudo install -d -o intended-owner -g intended-group -m 0750 /path/to/log-directory
Use the owner, group, and mode appropriate to the host. If the file itself is missing and Apache is expected to create it, ensure the directory is writable by the account that performs creation. If policy or operational practice requires a pre-created file, create it with restrictive initial permissions:
sudo install -o intended-owner -g intended-group -m 0640 /dev/null /path/to/error_log
Replace the placeholders with real local values; do not copy these commands unchanged into a production shell. Verify the result with stat and namei.
Correct ownership without broadening access
For an existing file or directory whose owner is wrong, change only that object:
sudo chown intended-owner:intended-group /path/to/error_log
sudo chmod 0640 /path/to/error_log
sudo chmod 0750 /path/to/log-directory
The modes above are examples of a restrictive pattern, not universal Apache defaults. Use the mode required by your package, service account, and log-rotation policy. Never use chmod -R 777 as a diagnostic shortcut. It can conceal the real problem, expose logs, and create a privilege-escalation risk.
Check SELinux, AppArmor, and other mandatory policy controls
When Unix owner, group, and mode bits are correct but Apache still receives permission denied, mandatory-access-control policy is the next branch. These systems can deny access even when discretionary permissions appear open.
SELinux
Check whether SELinux is enforcing and inspect recent denials in the audit log or system journal:
getenforce
sudo ausearch -m AVC,USER_AVC -ts recent
sudo journalctl -k --since "15 minutes ago"
A log directory moved outside the distribution’s expected location may have the wrong security context. Use the distribution’s documented method for labeling Apache log paths, commonly a persistent file-context rule followed by a context restore. Do not disable SELinux globally just to make startup succeed; that trades a local path problem for a host-wide security reduction.
AppArmor
Check the kernel journal and AppArmor status for a profile denial:
sudo aa-status
sudo journalctl -k --since "15 minutes ago" | grep -i apparmor
Apply the profile adjustment documented for your distribution and path. Keep the rule as narrow as possible: grant access to the intended log directory rather than an entire filesystem.
Free tools Windows power users keep installed
One-click scans. No signup required.
Validate syntax before restarting
Once the path and permissions are repaired, test the exact production configuration:
sudo apachectl -t
On installations that use the server binary directly:
sudo httpd -t
A successful result normally says Syntax OK. This check catches malformed directives and missing includes, but it does not prove that a service-manager start will succeed. It may also run under a different environment than the unit, so continue with an actual controlled restart.
Restart through the service manager and verify a fresh write
- Restart the correct unit:
sudo systemctl restart apache2orsudo systemctl restart httpd. - Immediately inspect status and the journal:
sudo systemctl status apache2 --no-pager -landsudo journalctl -u apache2 -n 50 --no-pager, substituting the unit name. - Confirm the service is active and that the journal contains no continuing permission denial.
- Check the configured error log’s modification time and tail it:
sudo tail -n 20 /path/to/error_log. - Make one harmless local request, then confirm that the configured access log receives a new entry. Use a local health URL or
curl http://127.0.0.1/only if that endpoint is appropriate for the host.
Do not declare success solely because apachectl -t passed. The durable test is a successful service start followed by an actual fresh log write.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common failure patterns and the right fix
| Observed symptom | Likely cause | What to check | Safer correction |
|---|---|---|---|
AH00015: Unable to open logs with Permission denied |
A file or parent directory denies access | namei -l, stat, directory modes, service account |
Restore intended owner/group and the minimum search/write permissions |
No such file or directory |
Configured directory, file, mount, or symlink target is absent | Resolve the path and inspect mounts and symlink targets | Create the intended directory/file or correct the configuration path |
| Global log looks correct, but startup still fails | An enabled virtual host defines another log path | Search all included configuration files | Repair the failing vhost path or remove an obsolete directive |
| Mode bits look correct but denial persists | SELinux/AppArmor or another mandatory policy denies access | Audit and kernel journals, enforcement/profile status | Apply a narrow, persistent policy or context correction |
| Apache starts, then fails after rotation | Rotation creates a file with the wrong owner/mode or cannot traverse the directory | Rotation configuration, post-rotate action, resulting metadata | Make rotation preserve the service’s required access and test a restart |
| Works manually but not as a service | The unit uses another binary, config, environment, namespace, or mount | Unit ExecStart, apachectl -V, service environment |
Fix the configuration used by the unit, not only the interactive command |
Log rotation can reintroduce the problem
A repair that survives one restart can still fail at the next rotation. Rotation may rename the current file, create a replacement, change ownership, compress it, or run a post-rotate restart. Review the rotation rule for every affected log and verify the metadata of the newly created file and directory.
Test the complete lifecycle in a maintenance window: rotate or simulate the operation according to the host’s documented procedure, restart Apache, and confirm both error and access logs receive entries. If rotation uses a dedicated group, ensure the directory’s search permission and the replacement file’s owner and mode remain compatible with Apache’s startup sequence.
Security: why a world-writable log directory is dangerous
Apache’s security guidance warns that anyone who can write to the directory where Apache writes a log can potentially gain the UID under which the server starts, normally root. A writable log directory is therefore not an innocuous workaround. An attacker may be able to replace a log path, create a link, or manipulate files before a privileged process opens them.
- Keep the log directory owned by the intended administrative or service accounts.
- Grant search and write access only to the accounts that need it.
- Use a dedicated group when a rotation or monitoring process requires shared access.
- Protect parent directories as well as the final file.
- Keep SELinux/AppArmor protections enabled and add narrow exceptions only when justified.
- Review permissions after package updates, configuration changes, and log rotation.
When changing the log path is the better repair
Sometimes the configured destination is obsolete: a disk was removed, a mount point changed, or a virtual host still references a retired directory. In that case, changing ErrorLog or CustomLog to an existing, policy-approved directory can be cleaner than recreating an abandoned path. Make the change in the active configuration, ensure the destination is covered by rotation and monitoring, run apachectl -t, and perform the full service-and-fresh-write verification.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Do not silently redirect logs to a temporary directory merely to make Apache start. That can lose audit data, fill the root filesystem, or bypass retention and access controls. The replacement path must have an ownership, rotation, backup, and security policy that the host can maintain.
A compact decision sequence
- Read the first failure: capture the exact unit, console, or journal message and path.
- Resolve the destination: identify the active configuration,
ServerRoot, and all global and virtual-host log directives. - Walk the path: run
namei -l,stat, and directory listings; inspect symlink targets and mounts. - Match identities: determine the service’s startup account, intended owner/group, and required modes.
- Repair narrowly: create only missing objects and restore least-privilege metadata; never use world-writable recursive permissions.
- Check mandatory policy: inspect SELinux or AppArmor denials when Unix permissions are not the explanation.
- Test and start: run the correct
apachectl -torhttpd -t, then restart through the service manager. - Prove durability: verify active status, a clean journal, a fresh error-log entry, an access-log entry, and behavior after rotation.
What a successful repair looks like
The final state is more than a green service status. The active Apache configuration resolves to real log destinations; every parent directory is traversable; the required owner, group, and modes are restored; mandatory-access-control policy permits the paths; syntax validation reports success; the service starts through its normal unit; and both configured logs accept fresh entries. If any one of those checks fails, the incident is not fully resolved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
