Audit log rotate on http server

Linux and Unix-Like Red Hat
1

I found somewhere online that you can set up log rotation for audit_log on httpserver so in my modsecurity.conf i switched logging conf from:

SecAuditLog logs/audit_log

to

SecAuditLog "|/usr/IBM/HTTPServer/bin/rotatelogs -l /usr/IBM/HTTPServer/logs/audit_log.%Y-%m-%d-%H_%M_%S 86400"

when this configuration is applied the file is not created and logging is not in a file that i want and it doesnt even log anything.

When i comment the new config and put back the default one with logs/audit_log it logs again to that file. Im trying to find a way to rotate this log since it can go up to 4 GB in a couple of months which is a lot. Has anyone found the way to do this?

Server version is: IBM_HTTP_Server/8.5.5.22 (Unix)

2

Hi @lomster

It is probably a good idea to perform some basic checks:

Verify the rotatelogs Path

• Ensure the rotatelogs binary exists at /usr/IBM/HTTPServer/bin/rotatelogs.

• Check with:

ls -l /usr/IBM/HTTPServer/bin/rotatelogs

Please post the output (using Markdown code blocks) of the above command.

Cheers!

3

Hi @lomster,

maybe you've missed a trailing double quote?

4

Missing the closing quote?

SecAuditLog "|/usr/IBM/HTTPServer/bin/rotatelogs -l /usr/IBM/HTTPServer/logs/audit_log.%Y-%m-%d-%H_%M_%S 86400"
5

Hey @Neo thanks for answer.
It exists i use it for logrotation of error_logs and access_logs

This is how i do that in httpd conf, but with this type im not sure how to format the logs for audit log

ErrorLog "|/usr/IBM/HTTPServer/bin/rotatelogs -l /usr/IBM/HTTPServer/logs/error_log.%Y-%m-%d-%H_%M_%S 86400"
CustomLog "|/usr/IBM/HTTPServer/bin/rotatelogs -l /usr/IBM/HTTPServer/logs/access_log.%Y-%m-%d-%H_%M_%S 86400" "%h %A:%p %l %u %t %{SSL_CLIENT_SERIALNUM}e \"%r\" %>s %b %T %D \"%{Referer}i\" \"%{User-Agent}i\"

Thats why i tried with modsecurity.conf

BR

6

Hi @bendingrodriguez i missed the double quotes while pasting, in my config on server its ok,

SecAuditLog "|/usr/IBM/HTTPServer/bin/rotatelogs -l /usr/IBM/HTTPServer/logs/audit_log.%Y-%m-%d-%H_%M_%S 86400"
7

Hi @MadeInGermany
As mention in my other answer, i have double quotes at the end, it slipped in my paste...

8

Yes, I figured missing the endiing " was a copy-and-paste issue. I do it all the time, these kind of mouse errors.

I see, so there is no permission error, as you have already checked and confirmed?

Example Only

sudo chmod -R 755 /usr/IBM/HTTPServer/logs/
sudo chown -R httpd_user:httpd_group /usr/IBM/HTTPServer/logs/

The user running the IBM HTTP Server (usually nobody or apache) must have write permissions to the /usr/IBM/HTTPServer/logs/ directory.

I'm sure you checked that already @lomster; but thought I would ask just to be complete since I cannot see your terminal :slight_smile: