I’ve gone ahead and implemented a mod_security service to logwatch as well, to aid in parsing through the audit_log that mod_security spits out as it does its work. I couldn’t find a decent one out there already written, so decided to write my own. It’s nothing fancy, but gets the job done. I figured I’d post it here in case someone else might find it useful.

Just place each file in the appropriate place… for my fedora core install, that happens to be in /etc/logwatch/* — exact locations for each file are then (click to download):

/etc/logwatch/conf/logfiles/audit_log.conf

/etc/logwatch/conf/services/mod_security.conf

/etc/logwatch/scripts/services/mod_security

Use at your own risk… :)