Configserver and Firewall custom rules log locations

competitions

• August 20, 2026 02:25

https://support.cpanel.net/hc/en-us/articles/360061771234-Common-Log-File-Locations
says
Apache Error Logs
/var/log/apache2/error_log

google AI 
says
/usr/local/apache/logs/error_log 
or 
/var/log/apache2/error_log

current CSF configuration says:

CUSTOM1_LOG = "/usr/local/apache/logs/error_log"
but lfd itself explicitly says:

"EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log {ModSecurity}
Watching /etc/apache2/logs/error_log…"

two separate things happening:

LFD is watching /etc/apache2/logs/error_log for ModSecurity.
Custom rule says CUSTOM1_LOG is /usr/local/apache/logs/error_log (based on cPanel documentation for apache errors log location).

Lines trying to catch are definitely in the log LFD is watching:
/etc/apache2/logs/error_log

Why investigate? My custom rule must not accidentally become active against the wrong log or start matching legitimate traffic.
I'm trying to determine if I:
change CUSTOM1_LOG,
change the custom rule's log selector,
use MODSEC_LOG instead of CUSTOM1_LOG, or
something else in LFD's processing.

I suspect other users have had issues with custom rules if they have used 
CUSTOM1_LOG = "/usr/local/apache/logs/error_log"

So anyone done custom rules and if so, did you have to change the log path to
CUSTOM1_LOG = "/etc/apache2/logs/error_log"
or 
CUSTOM1_LOG = "/var/log/apache2/error_log"

• 

  quietFinn

  • August 20, 2026 03:56

  lrwxrwxrwx 1 root root 17 Apr  8  2024 /usr/local/apache/logs -> /etc/apache2/logs
  and
  lrwxrwxrwx 1 root root 21 Jun 10 18:43 /etc/apache2/logs -> ../../var/log/apache2
  
  

  0
• 

  competitions

  • August 20, 2026 11:48

  Thanks!
  
  Looks like LFD requires the text path indicated by

  lfd itself explicitly says:

  "EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log {ModSecurity}
  Watching /etc/apache2/logs/error_log…"

  0

Please sign in to leave a comment.