Mod_Security logs..

[sh4ka]

Hello everyone,

Recently i compiled mod security as apache module by my own.... Now... Time ago I installed the add on "mod_security" from the AddOn Module at the WHM.. When I used this AddOn.. I was able to see the attack logs (sort by date, attack, action taken, IP, etc).. but now that I compiled mod security by my own from the source code I don't know where to find those logs? please can anyone tell me the path of attacks logs?

thkz!

[chirpy]

They're wherever you have configured them to be created in the mod_security container within httpd.conf using the SecAuditLog directive. Usually that is /usr/local/apache/logs/audit_log

[domenetorget]

Lately, these logs have been empty. Is there a problem with mod_security lately?
(I have 7 cPanel servers - and all of them have empty audit_log-files.)

[sh4ka]

the log is empty for me too ?????

[fred123123]

your logs are probably in /var/log/httpd/ ...

[fred123123]

i wonder if we can edit the file : /etc/cron.hourly/modsecparse.pl
to tell it that the log file is not the one in apache directory ...

I fear that it will be overwrited during an update/upgrade or anything ?

[sh4ka]

i know where my apache logs are, but they still empy :S