1. J

    ChatGPT script to generate hack alerts from mod_sec

    I sometimes struggle to understand what is going on with the logs of mod_sec so I can best thwart them. So I asked ChatGPT. It came up with a python script to send alerts and breakdown in plain language the alert. Here it is below. I haven't used it yet but thought it interesting enough to...
  2. J

    cryptic logs

    Hello. I hope everyone is safe and healthy. I am seeing the following notices and don't have a clue what they mean. Any guidance greatly appreciated. lfd on xxxxxxxx.com: Excessive processes running under userxxxxxx Time: Wed Mar 15 08:11:31 2023 -0400 Account: xxxxxxxxx...
  3. M

    Resource Usage Logs

    Hi at Resource Usage Dashboard, i get this Waring: You have reached the processes number limit 20 times. How can i log my resource usage, So i can analyze my site performance? P.S: I am user on the server but i ask the server admin to do it, if root needed. Ali
  4. T

    Looks like mod_security is blocking a file but cannot find where or find it in logs

    We have a developer installing WP in one of the prescribed methods, uploading files and running to get setup prompts for the wp-config.php file. This redirects to wp-admin/setup-config.php which is blocked with a 403 error. If I rename the file it runs just fine. The page doesn't show up in...
  5. E

    Received mail ⚠ Successful root Login from an Unknown Network -don´t see in logs

    Hello, I have cPanel&WHM version 106.0.15. I have received this mail: I do not see in any logs, messages, secure that from IP login was successuful. Where should I be able to see it? Best regards, Elizabeta
  6. B

    Are /home/virtfs logs shared and accessible between accounts?

    Trying to post, but it won't let me... I've attached my question as a PNG since it won't let me ask it as text. This forum is kind of ridiculous TBH.
  7. M

    Missing /home/user/logs folder new account setup

    Sorry for the wasted space. Found the solution at https://support.cpanel.net/hc/en-us/articles/360052289274-Missing-access-logs-in-home-directory-log-folder To generate the files in the log folder run the following command. /usr/local/cpanel/scripts/runweblogs <user> (But the strange thing is...
  8. S

    Exclude logs and bandwidth data from backup during Live Transfer?

    Is it possible to exclude bandwidth data and access logs from the backup process when running the Live Transfer to move accounts to a new server? They aren't needed in our case so it will only slow down the backup and restore process since we have hundreds of accounts to move.
  9. J

    deciphering mod_security logs

    Hello. I hope everyone is safe and healthy. Is this the right place to ask a question about mod_security logs? I keep getting the same log entries from mod_security via csf's lfd output but don't really understand them. Thanks.
  10. A

    Subdomain log

    Where we can find logs related to subdomain creation and deletion
  11. B

    Cloudflare shows user real IP in my site but not in the logs (CF IPs getting blocked by mod_qos)

    Hello, I have fixed users real IP by help of cpanel and this link: https://support.cpanel.net/hc/en-us/articles/360051107513-Restoring-visitors-IP-with-mod-remoteip But the problem is now that in the logs it still shows cloudflare IPs and when an attack happens mod_qos or evasive blocks...
  12. N

    SOLVED Clamav Error In Logs

    Hey everyone, received this error the last 3 days but before that all worked fine. Any ideas why this is happening? Server details: Centos 7.9 2009 Standard cPanel Version 104.0 (build 7) Apache Version 2.4.54 PHP Version 7.4.30 MySQL Version 5.7.39 Architecture x86_64...
  13. A

    cPanel metrics error logs taking 2 minutes or more

    Hey All, Since the latest update we've received complaints that Metrics/Errors is taking forever to load. Minutes sometimes and there is barley anything there. All other metrics load fast with no issue. Anyone come accross this? Thanks
  14. schoeps

    Log rotation of User logs (/home/username/logs)

    Is there an easy way to set the cap for these log files or just delete them en masse? It's unreasonable to deal with a logfile over a few megs and from time to time, users are hitting their disk cap because of these unruly logs.
  15. Spirogg

    easyapache 30 update seeing some errors?

    [2022-03-30 22:14:35 -0500] info [xml-api] Upgrading : ea-php80-php-fpm-8.0.17-1.2.3.cpanel.x86_64 41/218 [2022-03-30 22:14:35 -0500] info [xml-api] Running scriptlet: ea-php80-php-fpm-8.0.17-1.2.3.cpanel.x86_64 41/218 [2022-03-30 22:14:35 -0500] info [xml-api]...
  16. Spirogg

    In Progress CPANEL-40251 - While using Ubuntu a cPanel email shows wrong logs to search for

    Hello sorry I do t k ow how to word this any better. I have been testing Ubuntu and cPanel 102.08 more today. I got an error email and it says this below Log Messages The system could not provide log messages for “nginx” because it failed to read all of the potential log files with the...
  17. Spirogg

    SOLVED CPANEL-40250 - Change Logs are still showing 102.06 after upgrading to 102.07

    @cPRex @cPanelAdamF Whom ever is responsible for added change logs to cPanel they forgot to add 102.07 they are only showing v102.06 even though we upgraded and are on 102.07 and 102.08 still shows change log for 102.06 only in cPanel so maybe they forgot to add but its not showing latest...
  18. A

    Server IP showsing up in acess logs

    I noticed recently (since we had an attack on a website) that all of the logs on the server show up as the server's IP is the visitor. It's the same if I check WordFence on WordPress sites, visitors in cPanel of the sites, and logs straight on the server. I don't have this issue on other...
  19. Y

    In Progress ZC-9660 - Apache HTTPS access logs cannot correctly logged to ssl_log file after NGINX installed

    Hello, I recently installed NGINX reserve proxy on my server, and found that both Apache HTTP&HTTPS access are logged to the same file: /var/log/apache2/domlogs/<DOMAIN> I then manually change sslport argument in http.conf from port 444 to port 443, ie: CustomLog...
  20. H

    Accounts Terminated logs

    I need to find out the account terminated logs of a particular reseller child accounts from the last two months. is it available from accounting.log???