Symptoms

Log file modsec_audit.log does not rotate properly. As result it affects free disk space.

Cause

The mod_securtity log rotation script is missing or corrupted.

Resolution

1. Check if /etc/logrotate.d/mod_security is avaialble and have the following permissions:

   # stat /etc/logrotate.d/mod_security
   
   Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
   Access: 2015-09-16 02:05:55.819378168 +0600
   Modify: 2014-06-17 15:17:45.000000000 +0700
   Change: 2015-05-16 18:12:39.978778240 +0600
   

2. In case the file is missing create it with follwoing content:

   # vi /etc/logrotate.d/mod_security,
   
   /var/log/modsec_audit.log {
           daily
           rotate 7
           missingok
           compress
           postrotate
                   /sbin/service httpd reload > /dev/null 2>/dev/null || true
           endscript
   }
   

3. Set proper permissions:

   # chmod 0644 /etc/logrotate.d/mod_security