The error collection_store: Failed to access DBM file /var/cpanel/secdatadir/ip: Permission denied appears in Apache error logs when ModSecurity cannot write to its persistent data store. This causes ModSecurity rules that track IP-based counters (rate limiting, brute force detection) to fail silently.
chown -R nobody:nobody /var/cpanel/secdatadir/
chmod 700 /var/cpanel/secdatadir/
rm -f /var/cpanel/secdatadir/ip.*
systemctl restart httpd01. Root Cause
ModSecurity stores persistent collections (IP tracking, session data, rate limiting counters) in DBM files under /var/cpanel/secdatadir/. Apache runs as the nobody user and needs write access to this directory.
The permissions get corrupted when:
- A server migration or restore changes ownership to root
- A cPanel update resets permissions
- An admin manually changes ownership while troubleshooting
- The DBM files become corrupted after an unclean shutdown
02. Fix: Reset Permissions
- Fix ownership - Apache (nobody) must own the directory and files:
chown -R nobody:nobody /var/cpanel/secdatadir/ - Fix directory permissions:
chmod 700 /var/cpanel/secdatadir/ - Remove corrupted DBM files - they will be recreated automatically:
rm -f /var/cpanel/secdatadir/ip.* rm -f /var/cpanel/secdatadir/global.* - Restart Apache:
systemctl restart httpd
Only remove the .dir and .pag files inside the directory. Do not delete /var/cpanel/secdatadir/ itself. ModSecurity will not recreate the directory automatically - only the files within it.
03. Verify the Fix
# Check for new errors
tail -f /usr/local/apache/logs/error_log | grep collection_store
# Verify permissions
ls -la /var/cpanel/secdatadir/
# Should show: drwx------ nobody nobody
# Check DBM files are being created
ls -la /var/cpanel/secdatadir/ip.*
# Should show new files owned by nobody04. Preventing Recurrence
- After server migrations, check that
/var/cpanel/secdatadir/is owned by nobody - If using OWASP CRS, verify
SecDataDirin your modsec config points to the correct path - Monitor error logs - add this to your log monitoring:
grep "collection_store" /usr/local/apache/logs/error_log
The default path on cPanel servers is /var/cpanel/secdatadir/. This is set by the SecDataDir directive, typically in /etc/apache2/conf.d/modsec/modsec2.cpanel.conf. If your server uses a custom path, substitute accordingly.
Need Help With ModSecurity?
If ModSecurity errors persist or you need help configuring rules, contact our team.
Open a Support TicketFrequently Asked Questions
What does the ModSecurity collection_store DBM Permission denied error mean?
It means ModSecurity cannot write to its persistent data store at /var/cpanel/secdatadir. ModSecurity rules that track per-IP counters, such as rate limiting and brute-force detection, rely on that store, so when it cannot be written those rules fail silently while the error fills your Apache logs.
How do I fix the secdatadir Permission denied error?
As root, reset the ownership and permissions on /var/cpanel/secdatadir so ModSecurity can write to it, then verify the error stops appearing in the Apache error log. On cPanel the directory should be writable by the user that runs ModSecurity.
Is the collection_store error dangerous?
It does not take your site down, but it weakens security because the IP-tracking rules cannot store their counters, so rate limiting and brute-force protection stop working. It also floods the Apache error log. Fixing the permissions restores the protection and clears the log noise.
Do I need root to fix the secdatadir error?
Yes. The fix changes permissions on a system directory under /var/cpanel, which requires root, so it applies to VPS and dedicated servers. On shared hosting the server administrator handles it; open a ticket if you see this error on a shared account.
Quick Recap
- chown
/var/cpanel/secdatadir/to nobody:nobody - chmod 700 on the directory
- Remove corrupted ip.* and global.* DBM files
- Restart Apache
- Verify no new errors in error_log
20,888 users found this article useful · Last updated November 2026 · Browse all Server Maintenance articles
