I have the following apache setting (in conf.d/owasp-modsecurity.conf):

SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log"

When I do httpd -t I get the following error:

Syntax error on line 15 of /etc/httpd/conf.d/owasp-modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log

My intention should be reasonably obvious; I want mod_security audit log entries to end up in vhost-specific files. This already happens with regular access and error logs (though I've no idea how it is done).

For the record, I also tried the following entries blindly, none worked: $HOSTNAME ${SERVER_NAME} $SERVER_NAME and $HOST.

On a second though, these are environment variables...shouldn't there be something to get Apache internal variables instead?

Related links


Try to put the SecAuditLog entry into the setting for each of your virtual hosts.

Something like this (setup can look a little bit different but this is a basic setting). Also you could check your other log entries (CustomLog, ErrorLog etc) for possible wildcards to insert.

<VirtualHost *:80>
  ServerAdmin postmaster@domain1.com
  ServerName www.domain1.com

  SecAuditLog "/var/www/vhosts/domain1/statistics/logs/modsec_audit.log"
  # lots of more setting goes here
  # ...

<VirtualHost *:80>
  ServerAdmin postmaster@domain2.com
  ServerName www.domain2.com

  SecAuditLog "/var/www/vhosts/domain2/statistics/logs/modsec_audit.log"
  # lots of more setting goes here
  # ...
  • Thanks for the comment and clarification on wildcards. I was unsure about the wildcards - I've always worked with static log files myself – Jensd Apr 24 '13 at 8:38
  • @Jensd I don't know how the other log files work because they're done through Plesk. I can't go with the <VirtualHost> way because it would mean having to do this change manually each time a new domain is added. – Christian Apr 24 '13 at 8:42
  • @JennyD That point is not really feasible - the file is created only once (the first request) and opened when necessary (as is always the case). – Christian Apr 24 '13 at 8:44
  • Do you add domains very often? Perhaps you can edit some kind of virtualhost-template in the Plesk setup? – Jensd Apr 24 '13 at 8:50
  • @Jensd That's a possibility. My problem is that there are other people that may add domains. – Christian Apr 24 '13 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.