Directory /var/log/apache2/modsec_audit/<user>/YYYYMMDD... not being cleaned up

[Mysticeti]

The log files in this hierarchy are months and years old and apparently need to be cleaned up manually by an admin.

It would appear that the data in those folders count against end users' quota but they cannot access them to clean them up.

Is there a way to have the older files purged automatically?

 

[Spirogg]

The log files in this hierarchy are months and years old and apparently need to be cleaned up manually by an admin.

It would appear that the data in those folders count against end users' quota but they cannot access them to clean them up.

Is there a way to have the older files purged automatically?

I do not use mod sec so not sure if it shows up in logrotate

• Home /Service Configuration /cPanel Log Rotation Configuration
• cPanel Log Rotation Configuration

Files from /usr/local/cpanel/logs selected below will be rotated based upon their size. The rotated files will be compressed and stored in /usr/local/cpanel/logs/archive/. The files are named to include the month in which they are rotated. Consequently, the file names do not relate in any way to the content of the file being rotated. Files are only rotated when they grow larger than the Log Rotation Size Threshold setting or the default of 300MB. The archived log files are left in place indefinitely. Files not chosen here will not ever be rotated by cPanel software.

The archived log files are left in place indefinitely

The system stores the archived log files indefinitely, so you must remove them manually. Use the rm command to remove older log files.


Hope this helps
also

How to Clean Unmanaged Log Files

How to Clean Unmanaged Log Files | cPanel & WHM Documentation

This guide provides the steps to reduce the file size of the log files on your server that you do not manage through WHM's cPanel Log Rotation Configuration interface.

docs.cpanel.net

 

[cPRex]

We did add a way to rotate this log:

Add log rotation for mod_security logs

Since 2014-11-06 extensive logging has been done by mod_security under: /usr/local/apache/logs/modsec_audit/~username this presents 2 problems: 1) the

features.cpanel.net

Is that not working well for you?

 

[Mysticeti]

Thank you both for the info. Looks like I just need to create a cron job to delete any folders under /var/log/apache2/modsec_audit/<user> that are older than 7 days.