CSF and ModSecurity

[oxlab]

Hello! I'm having a problem with CSF and modSecurity. These are the logs in CSF conf file:

HTACCESS_LOG = "/usr/local/apache/logs/error_log"
MODSEC_LOG = "/usr/local/apache/logs/error_log"

But ModSecurity is using /usr/local/apache/domlogs/ to store all errors for each and every domain. The problem is that in error_log there are no errors so CSF didn't catch any of them.

My webserver configuration is: Nginx & Varnish & Apache, Comodo Rules and CWP Pro.

Thank you!

[evansa]

whats the question here?
Whats do you need assistance on?

[oxlab]

The problem is that CSF is not blocking modsecurity errors because they're logged at different files DOMAIN1.com.error.log, DOMAIN2.com.error.log, ...

CSF
----
HTACCESS_LOG = "/usr/local/apache/logs/error_log"
MODSEC_LOG = "/usr/local/apache/logs/error_log"

Thank you!

[Sandeep]

The problem is that CSF is not blocking modsecurity errors because they're logged at different files DOMAIN1.com.error.log, DOMAIN2.com.error.log, ...

CSF
----
HTACCESS_LOG = "/usr/local/apache/logs/error_log"
MODSEC_LOG = "/usr/local/apache/logs/error_log"

Thank you!

you can add each log or use wildcard log entry

[oxlab]

I think your suggestion was right.

HTACCESS_LOG = "/usr/local/apache/domlogs/*.error.log"
MODSEC_LOG = "/usr/local/apache/domlogs/*.error.log"

I can see CSF is now watching all those files

/var/log/lfd.log