Configserver and Firewall custom rules log locations
https://support.cpanel.net/hc/en-us/articles/360061771234-Common-Log-File-Locations
says
Apache Error Logs
/var/log/apache2/error_log
google AI
says
/usr/local/apache/logs/error_log
or
/var/log/apache2/error_log
current CSF configuration says:
CUSTOM1_LOG = "/usr/local/apache/logs/error_log"
but lfd itself explicitly says:
"EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log {ModSecurity}
Watching /etc/apache2/logs/error_log…"
two separate things happening:
LFD is watching /etc/apache2/logs/error_log for ModSecurity.
Custom rule says CUSTOM1_LOG is /usr/local/apache/logs/error_log (based on cPanel documentation for apache errors log location).
Lines trying to catch are definitely in the log LFD is watching:
/etc/apache2/logs/error_log
Why investigate? My custom rule must not accidentally become active against the wrong log or start matching legitimate traffic.
I'm trying to determine if I:
change CUSTOM1_LOG,
change the custom rule's log selector,
use MODSEC_LOG instead of CUSTOM1_LOG, or
something else in LFD's processing.
I suspect other users have had issues with custom rules if they have used
CUSTOM1_LOG = "/usr/local/apache/logs/error_log"
So anyone done custom rules and if so, did you have to change the log path to
CUSTOM1_LOG = "/etc/apache2/logs/error_log"
or
CUSTOM1_LOG = "/var/log/apache2/error_log"
-
lrwxrwxrwx 1 root root 17 Apr 8 2024 /usr/local/apache/logs -> /etc/apache2/logs
and
lrwxrwxrwx 1 root root 21 Jun 10 18:43 /etc/apache2/logs -> ../../var/log/apache20
Please sign in to leave a comment.
Comments
1 comment