Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the following apache setting (in conf.d/owasp-modsecurity.conf):

SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log"

When I do httpd -t I get the following error:

Syntax error on line 15 of /etc/httpd/conf.d/owasp-modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log

My intention should be reasonably obvious; I want mod_security audit log entries to end up in vhost-specific files. This already happens with regular access and error logs (though I've no idea how it is done).

For the record, I also tried the following entries blindly, none worked: $HOSTNAME ${SERVER_NAME} $SERVER_NAME and $HOST.

On a second though, these are environment variables...shouldn't there be something to get Apache internal variables instead?

Related links

share|improve this question

1 Answer 1

Try to put the SecAuditLog entry into the setting for each of your virtual hosts.

Something like this (setup can look a little bit different but this is a basic setting). Also you could check your other log entries (CustomLog, ErrorLog etc) for possible wildcards to insert.

domain1.conf
============
<VirtualHost *:80>
  ServerAdmin postmaster@domain1.com
  ServerName www.domain1.com

  SecAuditLog "/var/www/vhosts/domain1/statistics/logs/modsec_audit.log"
  # lots of more setting goes here
  # ...
</VirtualHost>

domain2.conf
============
<VirtualHost *:80>
  ServerAdmin postmaster@domain2.com
  ServerName www.domain2.com

  SecAuditLog "/var/www/vhosts/domain2/statistics/logs/modsec_audit.log"
  # lots of more setting goes here
  # ...
</VirtualHost>
share|improve this answer
    
Thanks for the comment and clarification on wildcards. I was unsure about the wildcards - I've always worked with static log files myself –  Jensd Apr 24 '13 at 8:38
    
@Jensd I don't know how the other log files work because they're done through Plesk. I can't go with the <VirtualHost> way because it would mean having to do this change manually each time a new domain is added. –  Christian Apr 24 '13 at 8:42
    
@JennyD That point is not really feasible - the file is created only once (the first request) and opened when necessary (as is always the case). –  Christian Apr 24 '13 at 8:44
    
Do you add domains very often? Perhaps you can edit some kind of virtualhost-template in the Plesk setup? –  Jensd Apr 24 '13 at 8:50
    
@Jensd That's a possibility. My problem is that there are other people that may add domains. –  Christian Apr 24 '13 at 9:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.