Idea: Mod_security logs for customers...

All it'd need to do is query the modsec database for the 'host' column (Host: header in modsec1, Host in section "b" of modsec2)

That'd work with any version of mod sec and require no handling of the log file itself.

The trick would be to make sure a cpanel user had no way to add or change data or view domains that were not theirs. (E.g one way would be a cronjob to copy entries in modsec that belonged to the user to user_modsec, then a UI in cPanel to view that database like in WHM)

 

This was sent to me, but then removed?

It may be somethign some might wonder about:

cPanel already parses, inserts into the database, and rotates the modsec log, so none of that would be necessary. Its pretty complex, especially modsec 2 so I don't recommend reinventing that wheel

All you need is to provide access to the data you want a userto have access to.

I could see user's being upset if someone else could see their data since it might give away private information.

 

That is a good point, the data isn't very useful to the end user. I can think of one case where it'd be useful:

If they have 'superapp' installed on their site and all of a sudden there are lots of rejected requests because its URL format is seen by a rule as bad.

The more I think about it though, if I was concerned with that on my site, I'd setup an ErrorDocument for 406's...

Since its already parsed into MySQL it'd be pretty trivial CPU-wise but yes spending resources on basically useless data is kind of a waste