Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIf Apache stops with AH00015: Unable to open logs or (13) Permission denied, fix the log destination before changing unrelated web-server settings. Apache opens its configured error and access logs during startup, before it launches less-privileged worker processes. A missing directory, an unreadable path component, a wrong owner or mode, a broken symlink, or an SELinux/AppArmor denial can therefore abort startup before a normal error log exists.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable repair is to capture the service-manager error, resolve the effective ErrorLog and CustomLog paths, inspect every directory in each path, restore the package’s intended ownership and least-privilege permissions, account for mandatory-access-control policy, then validate both configuration syntax and a real restart that writes a fresh log entry.
As an Amazon Associate I earn from qualifying purchases.
What “Unable to open logs” means
Apache HTTP Server (the httpd daemon) must open its configured log destinations while starting. The parent process performs this work before it creates worker processes that run under a less-privileged account. If the parent cannot traverse a directory, create or open a file, or follow a symlink to its target, startup can terminate immediately.
This explains a confusing symptom: Apache may fail before it can write the detailed diagnostic you normally expect in the error log. The Apache Software Foundation documents that a fatal startup problem is written to the console or to ErrorLog; when the log directory itself is inaccessible, there may be no usable ErrorLog at all. The service manager’s console output or journal is therefore the first source of evidence.
ErrorLog sets the error-log destination. A relative value is resolved relative to Apache’s ServerRoot, not relative to your shell’s current directory. A configuration that says ErrorLog logs/error_log can therefore point somewhere entirely different from /var/log/apache2 or /var/log/httpd. Virtual-host files can override or add log destinations, so checking only the global file is insufficient.
1. Capture the exact startup failure
Do not begin by recursively changing permissions. First preserve the exact message and path; it determines which branch of the diagnosis applies.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Run the service-manager status command for your distribution and record the complete output. Typical service names are
apache2andhttpd:sudo systemctl status apache2 --no-pager sudo systemctl status httpd --no-pager - Read the boot journal for the failed start. Substitute the service name that exists on your host:
sudo journalctl -u apache2 -b --no-pager sudo journalctl -u httpd -b --no-pager - Look for
AH00015,Permission denied,unable to open logs,No such file or directory, or a message naming a particular log path. Copy the path exactly, including capitalization and any symlink components. - If the service manager gives only a generic failure, run the distribution’s Apache control command in the foreground or use its configuration-test mode. A fatal startup message is often printed directly to the console even when the daemon cannot create an error-log entry.
Keep the original output. A later restart can replace the most useful journal lines with a less specific message.
2. Identify the active configuration and every log destination
Before changing a file, establish which binary, ServerRoot, main configuration file, and included virtual-host files the service actually uses. Administrators often repair /etc/apache2 while the service is using a custom build under another root, or fix the global log while a virtual host points to a different directory.
- Check the service unit or startup command to see whether it invokes
apache2,httpd, a wrapper, or a custom configuration path. The executable used by the unit is the one whose configuration test must be run. - Ask the active binary to show its compile-time paths, including
ServerRootand the default configuration file. For example:apachectl -V httpd -VUse the command that belongs to the service; do not assume a shell alias points to the same installation.
- Inspect the main configuration and all included files for log directives. On common layouts, searches resemble:
sudo grep -RInE '^s*(ErrorLog|CustomLog)b' /etc/apache2 /etc/httpdIf your configuration lives elsewhere, search that directory instead. Include files loaded by virtual-host definitions are part of the effective configuration.
- For each directive, resolve relative paths against the active
ServerRoot. Treat an absolute path as absolute; do not prependServerRootto it. Record both the error-log and access-log destinations because either one can block startup.
Do not infer the answer from a familiar default. A package may use /var/log/apache2, another may use /var/log/httpd, and a custom installation may use a path under its own ServerRoot.
3. Inspect the complete path, not just the final file
Unix permission checks apply to every component of a pathname. A correctly owned log file is still unreachable if one parent directory lacks search (x) permission for the account that must traverse it. Apache’s documented permission failures include a missing search permission on a path component.
- Ask
nameito display ownership and mode for each component:sudo namei -l /path/to/error_log - Inspect the final object and its metadata:
sudo stat /path/to/error_log sudo ls -ld /path /path/to /path/to/error_logIf the file does not exist, run
staton its parent directory and note whether that directory is present and writable by the process that creates the log. - Repeat the inspection for every
CustomLogdestination and for any symlink target.ls -lshows where a symlink points; runnamei -lon the resolved target as well. - Check for a read-only mount, filesystem-full condition, or immutable attribute if ownership and modes look correct. A permission-looking error can be a symptom of an unavailable or non-writable filesystem, so verify the mount state and free space before altering access controls.
Directory modes deserve special attention. The x bit means “search” or “traverse”; it is required to reach a child even when the child’s own mode appears open. The directory also needs the appropriate write permission if Apache or a log-rotation job must create a new file there.
4. Restore ownership and least-privilege permissions
Use the operating system package’s intended owner, group, and modes as the baseline. The correct values vary by distribution, installation method, and whether logs are opened by the privileged parent, a logging helper, or a separate rotation job. Do not guess an owner from the account used by worker processes.
Determine the accounts involved
- Inspect the service unit and Apache configuration for the account that runs worker processes. Common names differ between systems.
- Check the current metadata with
statand compare it with another log directory created by the same package, if one exists. - Remember that the startup parent commonly begins with administrative privileges and opens the logs before dropping privileges. A log file does not automatically need to be owned by the worker account.
Correct a missing directory or file
Create only the directory that the effective configuration requires, then assign the owner, group, and mode used by your package. An administrator can use install to create a directory with explicit settings:
sudo install -d -o <intended-owner> -g <intended-group> -m <intended-directory-mode> /path/to/log-directoryReplace the angle-bracket values with the actual package-defined settings; they are not universal Apache values. For an existing file, use chown and chmod only after confirming those settings. If the file is absent, creating an empty file with the wrong owner can cause the next restart or rotation to fail again.
Fix the smallest necessary scope
Repair the named directory, file, or symlink target rather than applying a recursive command to an entire filesystem tree. Never use chmod -R 777 as a diagnostic shortcut. It grants write access to every local user and can turn a logging directory into a privilege-escalation path.
The Apache documentation states: “Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.” Keep the directory owned by the intended administrative or service accounts and grant only the search and write permissions required for startup and rotation.
5. Check symlinks, missing parents, and log rotation
Symlink targets
A log path can look correct while its symlink target is inaccessible. Confirm that the link is not dangling, that every directory leading to the target is traversable, and that the target filesystem is mounted. If a deployment intentionally uses a symlink, repair the target’s ownership and policy labeling instead of replacing the link with an unrelated file.
Parent-directory creation
Creating only error_log does not help when /path/to/log-directory is absent. Build the parent hierarchy with the package’s expected modes, then retest. Avoid broad permissions on high-level directories such as /var or /var/log; access should be granted at the narrowest directory that contains Apache’s logs.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRotation and replacement files
A repair that works once but fails after rotation is incomplete. Log-rotation jobs may rename the old file and create a new one, or signal Apache to reopen logs. Inspect the rotation configuration for the same directory and verify that its creation rule preserves the required owner, group, mode, and security label. After the daemon is healthy, perform a controlled rotation or wait for the scheduled one, then confirm that a new entry is written.
6. Rule out SELinux or AppArmor denials
Mandatory access control can deny Apache even when Unix owner and mode bits look correct. SELinux labels and AppArmor profiles are independent of ordinary permissions.
- Check the host’s audit log and journal at the time of the failed start for an SELinux AVC denial or an AppArmor profile denial. The event normally identifies the executable, path, and blocked operation.
- If a denial names a custom log directory, apply the distribution’s documented method for assigning the correct Apache log-file type or updating the profile. Do not disable SELinux or AppArmor globally merely to make the service start.
- After policy remediation, re-run the path and metadata checks. A file can have the right label while a parent directory or symlink target still carries an incompatible one.
When the journal shows a policy denial, changing chmod alone will not solve the incident. Conversely, changing policy before confirming the path can hide a simple missing-directory error.
7. Test syntax, then perform a real start
A configuration test and a service start answer different questions. The test catches syntax and many path-resolution errors without leaving a running daemon; the restart proves that the service manager, privileges, policy, and log creation work together.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Run the test against the same binary and configuration used by the service:
sudo apachectl -t sudo httpd -tThe successful result is normally
Syntax OK. If one command tests a different installation, its result does not validate the service you are trying to start. - Start or restart through the service manager rather than launching an ad-hoc root process:
sudo systemctl restart apache2 sudo systemctl restart httpdUse the service name that exists on your host.
- Immediately check status and the journal for a continuing denial:
sudo systemctl status apache2 --no-pager sudo journalctl -u apache2 -b --no-pager - Confirm that the configured error log’s modification time advances and that it contains a fresh startup or request entry. Check the access log too when it is configured separately.
- Make an actual local request to a known virtual host, then verify that the request appears in the expected access log. This catches a virtual-host path that was not exercised by a simple daemon-status check.
Only declare the incident fixed when the service remains active, the expected files receive new entries, and the journal no longer reports permission failures.
Choosing among possible repairs
When several changes appear plausible, compare them against the same six checks: path correctness, owner and group, least-privilege mode, parent-directory search permission, mandatory-access-control state, and behavior after rotation and restart.
| Repair | Use it when | What to verify | Risk if applied blindly |
|---|---|---|---|
| Create the configured directory or file | The effective path is absent and the package expects Apache to create or use it | Every parent exists; owner, group, mode, and policy label match package defaults | Creating a plausible but unused path leaves the real failure unchanged |
| Correct owner/group or mode | namei -l or stat shows a mismatch |
The startup parent and rotation job can open or create logs without broad write access | Giving the worker account or all users unnecessary write access increases exposure |
| Repair a symlink target | The configured path resolves through a link to a missing or inaccessible target | Target and every parent are reachable, mounted, and correctly labeled | Replacing the link can break deployment layout or rotation assumptions |
| Restore SELinux/AppArmor policy | Audit or journal evidence shows a policy denial despite correct Unix permissions | The policy permits only the intended log paths and survives a restart | Disabling enforcement removes protection and obscures the underlying policy error |
| Fix rotation configuration | Startup works until a rotated file is created | New files retain required metadata and Apache reopens them successfully | A one-time manual fix will regress on the next scheduled rotation |
Common symptoms and the next diagnostic branch
| Symptom | Likely cause | Next action |
|---|---|---|
AH00015 names a directory that does not exist |
Configuration points to an uncreated log directory | Resolve the active path, create the directory with package-intended metadata, then run the syntax test |
Permission denied but the file mode looks open |
A parent directory lacks search permission, or SELinux/AppArmor blocks access | Run namei -l and inspect audit/journal policy denials |
| Global log is writable, but startup still fails | A virtual host’s ErrorLog or CustomLog points elsewhere |
Search all included configuration files and inspect every destination |
| Apache starts manually but not through systemd | The service uses a different binary, configuration, user, environment, or policy context | Inspect the service unit and test with its executable and configuration |
| The error returns after rotation | Rotation creates files with incorrect owner, mode, or security label | Fix the rotation rule and verify a complete rotate-and-reopen cycle |
| No Apache log exists after failure | Startup could not open the log destination | Use service status, console output, and the journal as the primary evidence |
Preventing a repeat incident
- Keep log directories under a controlled administrative owner; do not make them world-writable.
- Document the effective
ServerRootand the absolute paths produced from relativeErrorLogandCustomLogdirectives. - When adding a virtual host, review its log paths at the same time as its document root and certificate paths.
- Test log rotation after changing directory ownership, security labels, or service-unit settings.
- Include
apachectl -torhttpd -tin change procedures, but also perform a controlled restart and verify a fresh log entry. - Retain journal access for the service account and administrators so a failure that occurs before logging remains diagnosable.
Log access is not a cosmetic setting: it is a startup prerequisite and a security boundary. Resolve the exact effective path, repair only the failing component with least privilege, address mandatory policy when evidence points there, and verify the result through the same service manager and rotation path that production uses.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
