IBM Support

QRadar: HTTPd service fails to start due to "Invalid Mutex directory in argument file" error

Troubleshooting


Problem

This article explains how to diagnose and resolve when Apache HTTPd service fails to start with the message “Invalid Mutex directory in argument file: logs”.

 

Symptom

This error can occur when HTTPd service is not in a running state. The status of the HTTPd service can be verified by running the following command:
systemctl status httpd
The command returns output similar to the following:
httpd[18084]: AH00526: Syntax error on line 3 of /etc/httpd/conf/httpd.conf:
httpd[18084]: Invalid Mutex directory in argument file:logs/
systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
systemd[1]: Failed to start The Apache HTTP Server.
systemd[1]: Unit httpd.service entered failed state.
systemd[1]: httpd.service failed.

Cause

The log files related to the HTTPd service are stored in the /var/log/httpd directory. If this directory is missing, you can receive error messages similar to “Invalid Mutex directory in argument file: logs”.

Diagnosing The Problem

Verify whether the /var/log/httpd directory is present on the QRadar server.
ls -l /var/log/ | grep -i httpd
If this directory is missing, follow the procedure in Resolving The Problem.

Resolving The Problem

To create the /var/log/httpd directory, use the following command.
  1. SSH into the QRadar console.
  2. Create the /var/log/httpd directory. 
    mkdir -p /var/log/httpd
  3. Start the HTTPd service. 
    systemctl start httpd
  4. Verify the status of the HTTPd service. 
     systemctl status httpd

    Result
    The service starts and the error is resolved.
    ● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/httpd.service.d
           └─qradar.conf
   Active: active (running) since Wed 2022-11-16 03:45:44 EST; 27min ago
     Docs: man:httpd(8)
           man:apachectl(8)
 Main PID: 4603 (httpd)

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
21 November 2022

UID

ibm16615621

Page Feedback