ModSecurity: collection_store: Failed to access DBM file /var/cpanel/secdatadir/ip: Permission denied

The error collection_store: Failed to access DBM file /var/cpanel/secdatadir/ip: Permission denied appears in Apache error logs when ModSecurity cannot write to its persistent data store. This causes ModSecurity rules that track IP-based counters (rate limiting, brute force detection) to fail silently.

chown -R nobody:nobody /var/cpanel/secdatadir/
chmod 700 /var/cpanel/secdatadir/
rm -f /var/cpanel/secdatadir/ip.*
systemctl restart httpd

01. Root Cause

ModSecurity stores persistent collections (IP tracking, session data, rate limiting counters) in DBM files under /var/cpanel/secdatadir/. Apache runs as the nobody user and needs write access to this directory.

The permissions get corrupted when:

• A server migration or restore changes ownership to root
• A cPanel update resets permissions
• An admin manually changes ownership while troubleshooting
• The DBM files become corrupted after an unclean shutdown

02. Fix: Reset Permissions

1. Fix ownership - Apache (nobody) must own the directory and files:

   chown -R nobody:nobody /var/cpanel/secdatadir/

2. Fix directory permissions:

   chmod 700 /var/cpanel/secdatadir/

3. Remove corrupted DBM files - they will be recreated automatically:

   rm -f /var/cpanel/secdatadir/ip.*
   rm -f /var/cpanel/secdatadir/global.*

4. Restart Apache:

   systemctl restart httpd

03. Verify the Fix

# Check for new errors
tail -f /usr/local/apache/logs/error_log | grep collection_store

# Verify permissions
ls -la /var/cpanel/secdatadir/
# Should show: drwx------ nobody nobody

# Check DBM files are being created
ls -la /var/cpanel/secdatadir/ip.*
# Should show new files owned by nobody

04. Preventing Recurrence

• After server migrations, check that /var/cpanel/secdatadir/ is owned by nobody
• If using OWASP CRS, verify SecDataDir in your modsec config points to the correct path
• Monitor error logs - add this to your log monitoring:

  grep "collection_store" /usr/local/apache/logs/error_log

Quick Recap

1. chown /var/cpanel/secdatadir/ to nobody:nobody
2. chmod 700 on the directory
3. Remove corrupted ip.* and global.* DBM files
4. Restart Apache
5. Verify no new errors in error_log

20,888 users found this article useful · Last updated March 2026 · Browse all Server Maintenance articles