Modsec database 1GB of logs

[bsasninja]

I have this database and has logs from 2007, how do I flush all the logs??

the database is at /var/lib/mysql/modsec

Thanks

[cPanelDon]

I have this database and has logs from 2007, how do I flush all the logs??

the database is at /var/lib/mysql/modsec

An easy method would be to use phpMyAdmin via root WHM access to empty the table "modsec" within the database "modsec" -- all records are stored within the table.

Please refer to the following WHM menu path and documentation:
WHM: Main >> SQL Services >> phpMyAdmin

[jols]

I just noticed that the mod_security database is well over a gigabyte on some of our servers.

What's a good method of resetting, zeroing out this database, and by the way, what the heck is this database for?

Thanks for any advice.

[cPanelDon]

Moderator Note: For ease of finding related information I have merged two threads discussing the "modsec" MySQL database.

I just noticed that the mod_security database is well over a gigabyte on some of our servers.

What's a good method of resetting, zeroing out this database, and by the way, what the heck is this database for?

Thanks for any advice.

The MySQL database named "modsec" is used for storing log information from mod_security; if Mod Security is installed via EasyApache this data may be queried via the following menu path in WHM: Main >> Plugins >> Mod Security

Please see the following post for information on how to empty or reset the mod_security MySQL database "modsec": cPanel Forums - View Single Post - Modsec database 1GB of logs

[jols]

Thanks. Is this just a matter of accessing the modsec database in phpMyAdmin and then clicking the trash can (empty) in the table row? And then afterward mod_security on the server will hum along just fine?

Sorry, after all these years I am still a MySQL novice.

[cPanelDon]

Thanks. Is this just a matter of accessing the modsec database in phpMyAdmin and then clicking the trash can (empty) in the table row? And then afterward mod_security on the server will hum along just fine?

Yes; using the action "Empty" will correctly reset the contents of the affected database table. The action should reset it as if there are no log entries stored and I believe it will work without issue.

Here are the steps I would use to empty or reset the Mod Security database in MySQL:
1.) Access the following menu path: WHM: Main >> SQL Services >> phpMyAdmin
2.) Via the left-side browser frame navigate to the database named "modsec."
3.) Via the left-side browser frame navigate to the table named "modsec" -- this will Browse the table contents.
4.) Via the right-side browser frame click the red-colored action named "Empty." Please be careful; do not click "Drop."

[jols]

Thanks very much for these detailed instructions. In using them I was able to take down my /var load from 86% full down to 71% full.

This is something I had been struggling with every single night, i.e. keeping var from filling up.

Thanks once again!

[VeZoZ]

Maybe it would be a good idea to have some sort of old data removal built into the mod_security plugin? So maybe it's set be the administrator saying logs older than 6 months are removed or something? Just a thought as seems to be topics about this issue once in a while. So why not add some automation to this so people are not having issues with data that is several years old.

[cPanelDon]

Maybe it would be a good idea to have some sort of old data removal built into the mod_security plugin? So maybe it's set be the administrator saying logs older than 6 months are removed or something? Just a thought as seems to be topics about this issue once in a while. So why not add some automation to this so people are not having issues with data that is several years old.

I recommend to consider suggesting the desired enhancement (e.g., that could clean-up or expire old entries in the mod_security MySQL database) as a feature request in the following area on our forums; this will help bring more attention to your request and as more interest gathers it may be considered for implementation: Feature Requests for cPanel and WHM - cPanel Forums

If needed, upon request we can relocate your post into the Feature Requests forum area as a new thread.

[jols]

Thanks cPanelDon.

First, I'd much rather see cPanel.net come up with a way to set individual email account defaults, which is the leading cause of premature hair loss around here.