I can not see LSWS loging any activities but apache logging ok

The user runs cPanel/WHM on the server. We do not see any blocks of activity under the ModSec section in WHM when switching to LiteSpeed while switching to Apache, it is working fine and all the logs started showing all the blocks coming in.

When particular testing a rule, it did hit mod_security and returned 403 error on LSWS. It seems mod_security works fine on both Apache and LSWS, just no log on LSWS. Why does it happen?

There are two type of mod_security log mode: Concurrent or Serial.

SecAuditLogType Concurrent

or

SecAuditLogType Serial

Apache supports both mode while LSWS only supports Serial Audit log mode.

In the above example, Apache uses concurrent logger mode and cPanel is looking for another log to populate the “ModSecurity Tools” entries. How to fix?

Turning off mod_security concurrent logger configuration and change it to serial mode.