10

In my first PHP script in many years, I'm trying to log an error:

error_log("my error message", 3, $error_log);

I'm getting an error in the general Apache error log:

PHP Warning: error_log(/var/log/apache2/my_php_errors.log): failed to open stream: Permission denied in /var/www/html/blahblah/my_script.php on line 88

This is what I've checked and tried:

  • Created $error_log with the same ownership (root.adm) and permissions (640) as the Apache error log.
  • Changed the owner to www-data, which is the user PHP is running as.
  • log_errors is On.
  • open_basedir is not set.
  • Using PHP 5.5.x, so safe mode does not exist.

What am I missing?

Edit: It's able to write to the general Apache error log. The mystery is why it can't write to another file in the same directory with the same ownership and permissions.

Edit 2: Another developer told me that this works on his WAMP, so it's something specific to my LAMP stack or config.

Kevin Krumwiede
  • 9,868
  • 4
  • 34
  • 82
  • 2
    We need more info on `$error_log` variable. It's the destination towards the log file. Leave it empty for a default log file. For example, is it in or outside the web root directory. If outside you might want to check the allowed include path in the ini. – Xorifelse Mar 01 '16 at 19:33
  • Contact your server admin. – frosty Mar 01 '16 at 19:34
  • 1
    Try using 777 for files that PHP needs to write to and see if that works – Machavity Mar 01 '16 at 19:36
  • 3
    @frosty I am my own server admin. – Kevin Krumwiede Mar 01 '16 at 19:36
  • @Xorifelse It's exactly the file in the PHP error message. – Kevin Krumwiede Mar 01 '16 at 19:37
  • 1
    Also, make sure selinux is disabled. People always forget that one – Machavity Mar 01 '16 at 19:37
  • @Machavity Same error with 777. I'm developing on Ubuntu 14.04 desktop edition, which does not have selinux. Would apparmor affect this? – Kevin Krumwiede Mar 01 '16 at 19:42
  • @KevinKrumwiede Wasn't there when I commented. Since it's outside your webroot it is most definitely a permission issue. Do you run multiple websites, if not just leave out the `$error_log` variable so apache can use the default one. If you really want your own file try changing the permissions of that file with `chmod +xa /var/log/apache2/my_php_errors.log` or run it recursively on the folder. – Xorifelse Mar 01 '16 at 19:46
  • 1
    @Xorifelse I already described how I changed the permissions of that file. Anyway, why would I want it to be executable? – Kevin Krumwiede Mar 01 '16 at 19:49
  • @Machavity, you should not disable selinux. If selinux is blocking something, then you should set context appropriately instead. – wilbbe01 Aug 18 '16 at 13:58

2 Answers2

5

I had the same problem. https://serverfault.com/questions/831444/php-error-log-per-vhost/831666#831666

touch /path/to/php_error.log
chown www-data:www-data php_error.log
chmod 755 php_error.log

thanks for leading me to the answer!

Community
  • 1
  • 1
James Bailey
  • 498
  • 6
  • 19
  • 1
    That doesn't seem like it would have worked in my case, since I tried setting the owner to `www-data` and the permissions to the even broader `777`. Unfortunately, I no longer have access to the environment where I encountered this problem. – Kevin Krumwiede Mar 01 '17 at 06:23
  • PHP (or apache2) needs to have the ability to create and write a file in the directory. I had no problems by putting the log file in html directory, but I did not want the error_log file in the public viewable directory... Also, I did not want to broaden the scope of the virtual server root directory.. so I created the file in the root (touch), then set the broader permissions on just the file for it. – James Bailey Mar 02 '17 at 04:35
2

TL;DR: check that all the ancestor directories allow reads/lists by the web server.

On my system, my equivalent of /var/log/apache2/my_php_errors.log was giving this same error. I eventually did an ls -ld at every level of the path (/, /var/, /var/log/, /var/log/apache2/, /var/log/apache2/my_php_errors.log).

Four of those had permissions that made them readable by the web server. One of them, /var/log/apache2/ did not. When I moved my file out of the apache2 directory, everything started working. E.g. /var/log/php/ and set appropriate permissions/ownership (e.g. 750 by www-data.adm) on the new directory. 

prompt> ls -ld /var/log/php/
drwxr-x--- 2 www-data adm 4096 Nov  1 13:31 /var/log/php/

You could also change the permissions on /var/log/apache2/, but that seems like a security/privacy issue. It's safer to make a new directory and leave the existing structure as is.

The reason why the permissions have to change is that it is no longer using some version of syslog to publish to the log files. The syslog variants run as root and accept messages from non-root. But in my case, I was specifying the file from the web server, which made the permissions wrong.

There is a fix that uses syslog so that it could keep the same ownership. I did not try to make that work, as this is for a test server.

This may not have been the problem that you were having, but I'm pretty sure that I was using the default permissions for /var/log/apache2/. So it's quite possible that it was the problem. And even if it wasn't, this is one of the places I was searching for troubleshooting advice. So next time something like this happens to me, I'll have a reminder of what to check.

mdfst13
  • 850
  • 8
  • 18