# Anyone else httpd "client denied" errors in logs?

**URL:** <https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144>\
**Category:** Get Help\
**Created:** [January 22, 2019, 9:27pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144 "2019-01-22T21:27:36Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![azric](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/azric/32/63_2.png) [@azric](https://discourse.openondemand.org/u/azric)\
**Post date:** [January 22, 2019, 9:27pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/1 "2019-01-22T21:27:36Z")

</div>

My httpd error logs are full of noise like  
[Tue Jan 22 14:24:27.261723 2019] [access\_compat:error] [pid 22974] [client 150.135.159.198:64310] AH01797: client denied by server configuration: /opt/rh/httpd24/root/var/www/html/pun, referer: [https://ood.hpc.arizona.edu/pun/sys/dashboard/batch\_connect/sessions](https://ood.hpc.arizona.edu/pun/sys/dashboard/batch_connect/sessions)  
(about 30k of these per day!).

In spite of how dire that looks, OnDemand seems to work correctly. Is anyone else experiencing this? I’m not sure if this is a leftover from upgrading from OnDemand pre-rpm or a config I missed or ??

---

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [January 30, 2019, 6:55pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/2 "2019-01-30T18:55:56Z")

</div>

I have not seen this unfortunately. /opt/rh/httpd24/root/var/www/html/ is an empty directory. My guess is that this is the default directory Apache serves static files out of. Is it possible that a directive in your Apache config is set to try to serve static files on each request, like it tries /opt/rh/httpd24/root/var/www/html/ first, then falls back to default functionality? Is this occurring on every request? I assume so since you said 30k per day.

Just guessing. @tdockendorf knows a lot more than me about Apache and might be able to comment.

Also, maybe if you share the Apache config, or non-sensitive parts /opt/rh/httpd24/root/etc/httpd/conf.d/ood-portal.conf. Of course feel free to email me directly anything you don’t want on Discourse.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [January 30, 2019, 8:19pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/3 "2019-01-30T20:19:15Z")

</div>

Would need to upload redacted copies of .conf files in /opt/rh/httpd24/root/etc/httpd/conf and /opt/rh/httpd24/root/etc/httpd/conf.d. The default DocumentRoot for stock httpd24-httpd install points to /opt/rh/httpd24/root/var/www/html but the virtual host used by OnDemand should prevent that from having an effect I think, though one is not defined for OnDemand configs.

---

<div class="post-metadata">

**Author:** ![azric](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/azric/32/63_2.png) [@azric](https://discourse.openondemand.org/u/azric)\
**Post date:** [January 30, 2019, 8:39pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/4 "2019-01-30T20:39:08Z")

</div>

I’ve emailed the requested bits to Eric Franz directly and asked him to share with you; I don’t think anything in there is secret, but …

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [January 30, 2019, 9:57pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/5 "2019-01-30T21:57:27Z")

</div>

Try commenting out `DocumentRoot` from `/opt/rh/httpd24/root/etc/httpd/conf/httpd.conf`. Should be able to apply change with `systemctl reload httpd24-httpd`. I can’t reproduce the logs in vagrant environment that matches stock install. Our production and test environments all use Puppet and Puppet removes things like `DocumentRoot` from `httpd.conf`.

---

<div class="post-metadata">

**Author:** ![azric](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/azric/32/63_2.png) [@azric](https://discourse.openondemand.org/u/azric)\
**Post date:** [February 4, 2019, 9:09pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/6 "2019-02-04T21:09:07Z")

</div>

I tried mucking with DocumentRoot, but that didn’t do much useful. What did solve my problem with access\_compat:error complaining about every /pun reference was  
overloading lua\_log\_level as  
lua\_log\_level: ‘info access\_compat:crit’  
to suppress the errors from access\_compat.

---

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [February 5, 2019, 4:10pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/7 "2019-02-05T16:10:46Z")

</div>

This could also be the result of mixing Apache 2.2 directives like `Order` and `Satisfy` with Apache 2.4 directives like `Require`. The old directives are supplied by the module [http://httpd.apache.org/docs/2.4/mod/mod\_access\_compat.html](http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html) and since the errors you were seeing in the logs were from access\_compat perhaps those would also go away if you avoided using those directives altogether. I only just now stumbled across [http://httpd.apache.org/docs/2.4/upgrading.html](http://httpd.apache.org/docs/2.4/upgrading.html) which mentions changing from 2.2. to 2.4 but the examples it gave did not show our use case:

```auto
Order allow,deny
Satisfy Any

```

So I don’t know what the corresponding [Require](http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require) directive for this would be. Since there is already `Require valid-user` is it possible to just remove those last two directives?

Though it looks like you already found a workable solution - just ignore those errors.

---

<div class="post-metadata">

**Author:** ![azric](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/azric/32/63_2.png) [@azric](https://discourse.openondemand.org/u/azric)\
**Post date:** [February 5, 2019, 9:19pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/8 "2019-02-05T21:19:36Z")

</div>

Bingo Eric:

Removing the

order ….

satisfy …

pair from the configuration resolved the problem without needing to overload LUA logging.

Ric

![](https://us1.discourse-cdn.com/flex015/uploads/osc/original/1X/54c580f4e983c4f3324813299ea8bd276a059acb.png)

![](https://us1.discourse-cdn.com/flex015/uploads/osc/original/1X/c77c2ac9082691ea7b08cd12b20a0c072cbd1946.png)

---

<div class="post-metadata">

**Author:** ![westburg.2](https://avatars.discourse-cdn.com/v4/letter/w/0ea827/32.png) [@westburg.2](https://discourse.openondemand.org/u/westburg.2)\
**Post date:** [May 26, 2022, 3:16pm UTC](https://discourse.openondemand.org/t/anyone-else-httpd-client-denied-errors-in-logs/144/9 "2022-05-26T15:16:00Z")

</div>