1

I have the following apache setting (in conf.d/owasp-modsecurity.conf):

SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log"

When I do httpd -t I get the following error:

Syntax error on line 15 of /etc/httpd/conf.d/owasp-modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log

My intention should be reasonably obvious; I want mod_security audit log entries to end up in vhost-specific files. This already happens with regular access and error logs (though I've no idea how it is done).

For the record, I also tried the following entries blindly, none worked: $HOSTNAME ${SERVER_NAME} $SERVER_NAME and $HOST.

On a second though, these are environment variables...shouldn't there be something to get Apache internal variables instead?

Related links

1 Answer 1

2

Try to put the SecAuditLog entry into the setting for each of your virtual hosts.

Something like this (setup can look a little bit different but this is a basic setting). Also you could check your other log entries (CustomLog, ErrorLog etc) for possible wildcards to insert.

domain1.conf
============
<VirtualHost *:80>
  ServerAdmin [email protected]
  ServerName www.domain1.com

  SecAuditLog "/var/www/vhosts/domain1/statistics/logs/modsec_audit.log"
  # lots of more setting goes here
  # ...
</VirtualHost>

domain2.conf
============
<VirtualHost *:80>
  ServerAdmin [email protected]
  ServerName www.domain2.com

  SecAuditLog "/var/www/vhosts/domain2/statistics/logs/modsec_audit.log"
  # lots of more setting goes here
  # ...
</VirtualHost>
5
  • Thanks for the comment and clarification on wildcards. I was unsure about the wildcards - I've always worked with static log files myself
    – Jensd
    Apr 24, 2013 at 8:38
  • @Jensd I don't know how the other log files work because they're done through Plesk. I can't go with the <VirtualHost> way because it would mean having to do this change manually each time a new domain is added.
    – Christian
    Apr 24, 2013 at 8:42
  • @JennyD That point is not really feasible - the file is created only once (the first request) and opened when necessary (as is always the case).
    – Christian
    Apr 24, 2013 at 8:44
  • Do you add domains very often? Perhaps you can edit some kind of virtualhost-template in the Plesk setup?
    – Jensd
    Apr 24, 2013 at 8:50
  • @Jensd That's a possibility. My problem is that there are other people that may add domains.
    – Christian
    Apr 24, 2013 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .