Modsecurity errors not present in domain error file - directadmin - modsecurity with comodo

[axanti]

Hello,
I allow myself to trace what appears to be a bug.
I installed directadmin + openlitespeed + modsecurity + comodo
I tested the following url: http://domainname.com/?r=/etc/passwd
I have a 403 error that appears on the screen, however this error does not appear in the error log file (/var/log/httpd/domains/domainname.com.error.log)
On the same server I changed to the apache web server and the modsecurity errors appear in the log file of the domain name, so I went back to the openlitespeeed web server and the modsecurity errors no longer appear in the file domain name logs.
When openlitespeed is active, the errors do appear on the other hand in the log file modsec_audit.log which is located in /var/log/httpd
The concern is that the csf / lfd firewall does not block the IP addresses in error because the errors do not appear ...
Is this a bug?
Is there a configuration to be done in openlitespeed so that errors appear in the logs file for each domain name?
Please help me with this.
Thank you.

 

[Wanabo]

I recently gave DA+OLS a try, because it supports http/3 out of the box.
Stumbled upon this thread because I have the same problem. (DA+modsecurity+modsecurity rules) Four years has passed and still no solution. Found even an older thread from 2008 addressing this problem, litespeed-is-not-working-with-mod-security. And 2010, csf-firewall.

I need domainname.com.error.log files filled with modsecurity messages, because Configserver csf/lfd can scan these files and filter out ip-addresses to block them in the firewall. If necessary I can write my own regex for cfd/lfd regex.custom.pm to parse/match reports in domainname.com.error.log
It is part of my server security!

Is this supported by OLS?
Is a modification known to make is so?

 

[Cold-Egg]

I just did a quick test for OLS + OWASP, and the error log logs " [INFO] [146419] [1.2.3.4:59423:HTTP2-11#wordpress] [Module:mod_security] ModSecurity: Warning. Matched "Operato ..." as expected on both server and virtual host levels. So you might want to check if theLog Level has INFO included.