On This Page

  1. Apache events

Additional Linux configuration for dhound-agent

Some security events requires additional linux configuration. If you select Autodetect security events on server or selected the rules below, you need to make some additional configuration on server that will allow dhound-agent collecting these security events.

Apache events

Make sure that default Apache log format is vhost_combined (default apache log level). It will allow to add additional information (a domain name) for the following security events:

This is usefull information when several sites installed on the server.

Make sure that apache virtual servers configs (Ubuntu/Debian:/etc/apache2/sites-enabled/*.conf) does not contain CustomLog option or it has the following view:

CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
Restart apache if any changes.

See Also