> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-configure-an-enginsight-siem-extractor-for-an-apache-http-server.md).

# How do I configure an Enginsight SIEM extractor for an Apache HTTP Server?

By default, the Apache HTTP Server writes its logs to local file directories. However, to allow Enginsight to collect and process the logs, they must be forwarded via syslog.

In this article, we show you how to configure the Apache HTTP Server so that logs are provided in the correct format and can be processed by the Enginsight SIEM.

You can then [create a suitable Syslog Collector](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays/add-event-relay) in the Enginsight platform under **SIEM** → **General Collectors** → [Event Relays](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays).

***

{% stepper %}
{% step %}

### Open the Apache HTTP Server configuration file

Open the Apache HTTP Server configuration file using the following command:

* **Debian-based system**:

```
sudo nano /etc/apache2/apache2.conf
```

* **Red Hat Enterprise Linux (RHEL)-based system**:

```
sudo nano /etc/httpd/conf/httpd.conf
```

{% endstep %}

{% step %}

### Add `GlobalLog` entries

1. Add the following entries to the configuration file or adjust them if they already exist:

<pre><code>LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

<strong>GlobalLog "|/usr/bin/logger -t httpd -p local0.info" &#x3C;LogFormat>
</strong></code></pre>

The different log formats mean the following:

<table><thead><tr><th width="235.359375">Format</th><th>Description</th></tr></thead><tbody><tr><td><code>vhost_combined</code></td><td>This format includes virtual hosts, referrer, and user agent.</td></tr><tr><td><code>combined</code></td><td>This format includes referrer and user agent.</td></tr><tr><td><code>common</code></td><td>This is the simplest format and includes neither referrer nor user agent.</td></tr></tbody></table>

2. In the `GlobalLog` entry, replace the `<LogFormat>` parameter with one of the previously defined log formats (`vhost_combined`, `combined`, or `common`).

{% hint style="danger" %}
**Please note**: The value `httpd` is used in the Enginsight SIEM as the value for the **syslog.app\_name** field and must not be changed.
{% endhint %}
{% endstep %}

{% step %}

### Add `ErrorLog` entries

1. Add the following entries to the configuration file:

<pre><code>ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M"
<strong>LogLevel &#x3C;LogLevel>
</strong>ErrorLog "|/usr/bin/logger -t httpd -p local0.info"
</code></pre>

2. Replace the `<LogLevel>` parameter with one of the following severity levels for log entries:

* `debug`
* `info`
* `notice`
* `warn`
* `error`

{% hint style="info" %}
We recommend setting the log level to `notice`.
{% endhint %}
{% endstep %}

{% step %}

### Save the changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Restart the Apache HTTP Server

Restart the Apache HTTP Server using the following command for the changes to take effect:

* **Debian-based system**:

```
sudo systemctl restart apache2
```

* **RHEL-based system**:

```
sudo systemctl restart httpd
```

{% endstep %}

{% step %}

### Check the syslog

Make sure that the Apache HTTP Server logs now appear in `/var/log/syslog` or `/var/log/messages`. This depends on the operating system configuration.

Check whether access logs and error logs are forwarded correctly in the specified format.
{% endstep %}
{% endstepper %}

***