Skip to content

Apache: fix the documentation #2832

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
squioc wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Apache: fix the documentation #2832

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 45 additions & 42 deletions docs/integration/categories/applicative/apache.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,47 +65,50 @@ This setup guide will show you how to forward both your access and error logs to

#### Detailed Procedure:

1. **Install and Configure Rsyslog:**
- Ensure that the `rsyslog` package is installed on your server.
- Load the `imfile` module to read log files:

```bash
$ModLoad imfile
```

2. **Configure Rsyslog to Monitor Apache Log Files:**
- Add the following configuration to your `rsyslog` configuration file (usually found in `/etc/rsyslog.conf` or `/etc/rsyslog.d/`):

```bash
# Error log
$InputFileName /var/log/apache2/error.log
$InputFileTag apache:
$InputFileStateFile stat-apache-error
$InputFileSeverity error
$InputFileFacility local5
$InputFilePollInterval 1
$InputRunFileMonitor

# Access log
$InputFileName /var/log/apache2/access.log
$InputFileTag apache:
$InputFileStateFile stat-apache-access
$InputFileSeverity notice
$InputFileFacility local5
$InputFilePollInterval 1
$InputRunFileMonitor
```

3. **Forward Logs to a Concentrator:**
- Configure rsyslog to forward logs to a syslog concentrator:

```bash
*.* action(type="omfwd"
target="<Concentrator_FQDN_or_IP>"
port="<Remote_Port>"
protocol="tcp"
TCP_Framing="octet-counted"
)
1. **Install Rsyslog:**
- Ensure that the `rsyslog` package is installed on your server.

2. **Create a dedicated configuration**
- Add a dedicated configuration file for Apache logs in `/etc/rsyslog.d/17-apache.conf`:

```text
module(load="imfile" PollingInterval="5")
module(load="omfwd")

input(
type="imfile"
File="/var/log/apache2/error.log"
Tag="apache-error:"
Facility="local5"
Severity="error"
StateFile="stat-apache-error"
PersistStateInterval="200"
Ruleset="apache-logs"
)

input(
type="imfile"
File="/var/log/apache2/access.log"
Tag="apache-access:"
Facility="local5"
Severity="notice"
StateFile="stat-apache-access"
PersistStateInterval="200"
Ruleset="apache-logs"
)

ruleset(name="apache-logs") {
# Forward to remote concentrator
action(
type="omfwd"
target="CONCENTRATOR_FQDN_OR_IP"
port="REMOTE_PORT"
Comment on lines +104 to +105
Copy link

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The placeholder format is inconsistent with the established convention in this codebase. According to the pattern used in other integration documentation files (bind.md:101, haproxy.md:94, spamassassin.md:89-90), placeholders for rsyslog configuration should use angle brackets with mixed case (e.g., <Concentrator_FQDN_or_IP> and <Remote_Port>), not uppercase without angle brackets. Please change CONCENTRATOR_FQDN_OR_IP to <Concentrator_FQDN_or_IP> and REMOTE_PORT to <Remote_Port> to maintain consistency across the documentation.

Suggested change
target="CONCENTRATOR_FQDN_OR_IP"
port="REMOTE_PORT"
target="<Concentrator_FQDN_or_IP>"
port="<Remote_Port>"

Copilot uses AI. Check for mistakes.
protocol="tcp"
TCP_Framing="octet-counted"
)
Comment on lines +100 to +108
Copy link

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The example omfwd action forwards Apache logs over plain TCP without any transport encryption, which can expose log contents (URLs, cookies, tokens, or other sensitive data) to interception by an attacker on the network path. An adversary with access to the network between the Apache host and CONCENTRATOR_FQDN_OR_IP could passively capture or tamper with these logs. Consider documenting a configuration that uses TLS (e.g., gtls stream driver and certificate validation) for remote log forwarding, or clearly scoping this example to trusted, isolated networks where plaintext is acceptable.

Copilot uses AI. Check for mistakes.
# Prevent further processing of these messages
stop
}
Comment on lines +75 to +111
Copy link

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code block content has extra indentation that should be removed. The rsyslog configuration lines (starting from line 75) should not have the leading 8 spaces of indentation. In markdown code blocks, the content should start at the left margin (or with minimal consistent indentation). Compare with similar examples in auditbeat_linux.md:234-254 or varonis_data_security.md:58-76 where the code block content starts at the left margin without extra indentation.

Suggested change
module(load="imfile" PollingInterval="5")
module(load="omfwd")
input(
type="imfile"
File="/var/log/apache2/error.log"
Tag="apache-error:"
Facility="local5"
Severity="error"
StateFile="stat-apache-error"
PersistStateInterval="200"
Ruleset="apache-logs"
)
input(
type="imfile"
File="/var/log/apache2/access.log"
Tag="apache-access:"
Facility="local5"
Severity="notice"
StateFile="stat-apache-access"
PersistStateInterval="200"
Ruleset="apache-logs"
)
ruleset(name="apache-logs") {
# Forward to remote concentrator
action(
type="omfwd"
target="CONCENTRATOR_FQDN_OR_IP"
port="REMOTE_PORT"
protocol="tcp"
TCP_Framing="octet-counted"
)
# Prevent further processing of these messages
stop
}
module(load="imfile" PollingInterval="5")
module(load="omfwd")
input(
type="imfile"
File="/var/log/apache2/error.log"
Tag="apache-error:"
Facility="local5"
Severity="error"
StateFile="stat-apache-error"
PersistStateInterval="200"
Ruleset="apache-logs"
)
input(
type="imfile"
File="/var/log/apache2/access.log"
Tag="apache-access:"
Facility="local5"
Severity="notice"
StateFile="stat-apache-access"
PersistStateInterval="200"
Ruleset="apache-logs"
)
ruleset(name="apache-logs") {
# Forward to remote concentrator
action(
type="omfwd"
target="CONCENTRATOR_FQDN_OR_IP"
port="REMOTE_PORT"
protocol="tcp"
TCP_Framing="octet-counted"
)
# Prevent further processing of these messages
stop
}

Copilot uses AI. Check for mistakes.
```

!!! Note
Expand All @@ -128,4 +131,4 @@ This setup guide will show you how to forward both your access and error logs to
## Further readings

- The code of the Intake format is available [here](https://github.com/SEKOIA-IO/intake-formats/tree/main/Apache).
- [Apache documentation](http://httpd.apache.org/docs/).
- [Apache documentation](http://httpd.apache.org/docs/).
Loading