How To Add Log Files To CSF

The ConfigServer Security and Firewall plugin for your VPS does a better job at managing your server’s firewall than the default option. In addition to being more user-friendly, it has a bunch of useful features that I wouldn’t want to do without. One of the more useful features is the ability to monitor a long list of log files from a single drop-down box. By default, CSF comes with a few log files already listed, but you can add more. This tutorial will show you how to add log files to the CSF plugin.

CSF is a default plugin that comes with all NameHero Managed Cloud packages, so if you get a NameHero VPS, you won’t need to worry about installing or updating it.

Existing Log Files

The CSF dashboard allows you to monitor and search log files as shown here:

When you click “Watch System Logs”, you get a dropdown box where you can select the log files you want to monitor. These also helpfully refresh after a certain period that you can configure separately. You can also pause the refresh whenever you want. All told, it’s an amazingly useful tool that centralizes your log file management.

However, each installation is different, and it’s unlikely that the default CSF logs will contain everything you want. For example, my CSF configuration didn’t contain the Apache access files for my two domains:

The screenshot above shows the default logs with my two custom logs added above since I already added them in for this tutorial, and I don’t want to remove the entries just for the screenshot :). You can see that there are quite a few log files already included, but not the ones I wanted.

Adding New Log Files to CSF

To add new log files to this entry, you’ll have to SSH into your server. Unfortunately, there’s no graphical user interface that I could find where I could make the entries manually, so you have no choice but to use the command line. Moreover, these files are located in a privileged location, so you’ll need to either use sudo (recommended) or log in as root (not recommended). I’ve written a tutorial earlier on how to create a user with sudo privileges that you might find useful.

With the appropriate access, navigate to and open the following file:

/etc/csf/csf.syslogs

This is the default location for the file that contains the list of log files that CSF should monitor. The list is quite long, but most of them will be irrelevant to your installation. In this screenshot, I have Apache as my web server, so I add my two log files to the bottom of the list as shown here:

Just add them as ordinary lines in the text, save your changes, and exit.

Restart CSF

The next step is for CSF to notice your changes and incorporate them into your configuration. To do this, type the following command in the terminal – again with the right permissions:

csf -r

This will restart the CSF plugin and cause it to reload all the configuration files – including the ones you just added. The next time you access your CSF dashboard, you should be able to see the new log file entries, and you can monitor them like any other.