Plesk services logs and configuration locations on LINUX

Plesk Services Index

• Logs:
  • Error log: /var/log/sw-cp-server/error_log and /var/log/sw-cp-server/sw-engine.log
  • Access log: /usr/local/psa/admin/logs/httpsd_access_log
  • Panel log: /usr/local/psa/admin/logs/panel.log
• Service control:
  • Stop: /etc/init.d/psa stop
  • Start: /etc/init.d/psa start
  • Restart: /etc/init.d/psa restart
• Configuration:
  • PHP config: /usr/local/psa/admin/conf/php.ini
  • Panel config: /usr/local/psa/admin/conf/panel.ini
  • Web server config: /etc/sw-cp-server/conf.d/plesk.conf

• Service control:
  • Stop Plesk Firewall Service: /etc/init.d/psa-firewall stop
  • Start Plesk Firewall Service: /etc/init.d/psa-firewall start
  • Restart Plesk Firewall Service: /etc/init.d/psa-firewall restart
• Configuration:
  • /usr/local/psa/var/modules/firewall/firewall-active.sh
  • /usr/local/psa/var/modules/firewall/firewall-emergency.sh
  • /usr/local/psa/var/modules/firewall/firewall-new.sh

What is ModSecurity: ModSecurity is an open-source web-based firewall application (or WAF) supported by different web servers: Apache, Nginx and IIS.

• Logs:
  • /var/log/httpd/modsec_audit.log
  • /var/www/vhosts/domain.tld/logs/error_log
• Service control:
  • Disable ModSecurity Service: /usr/local/psa/admin/bin/modsecurity_ctl -d
  • Enable ModSecurity Service: /usr/local/psa/admin/bin/modsecurity_ctl -e

What is Fail2ban :Fail2ban scans log files (for example /var/log/apache/error_log) and bans IPs that show the malicious signs — too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).

• Service control:
  • Stop Fail2Ban: /etc/init.d/fail2ban stop
  • Start Fail2Ban: /etc/init.d/fail2ban start
  • Restart Fail2Ban: /etc/init.d/fail2ban restart
• Configuration:
  • iptables -N fail2ban-plesk-login
  • iptables -A fail2ban-plesk-login -j RETURN
  • iptables -A INPUT -p tcp -m multiport –dports 8880,8443 -j fail2ban-plesk-login

What is Tomcat: Tomcat is an application server from the Apache Software Foundation that executes Java servlets and renders Web pages that include Java Server Page coding.

• Logs:
  • /var/log/tomcat5/*
• Service control:
  • Stop Tomcat Service: /etc/init.d/tomcat5 stop
  • Start Tomcat Service: /etc/init.d/tomcat5 start
  • Restart Tomcat Service: /etc/init.d/tomcat5 restart
• Configuration:
  • /etc/tomcat5/server.xml

What is Postfix: Postfix is Wietse Venema’s mail server that started life at IBM research as an alternative to the widely-used Sendmail program.

• Logs:
  • /usr/local/psa/var/log/maillog
• Service control:
  • Stop Postfix Service: /etc/init.d/postfix stop
  • Start Postfix Service: /etc/init.d/postfix start
  • Restart Postfix Service: /etc/init.d/postfix restart
• Configuration:
  • /etc/postfix/master.cf
  • /etc/postfix/main.cf

What is Named /BIND: BIND (Berkely Internet Name Domain) is a popular software for translating domain names into IP addresses and usually found on Linux servers.

• Logs:
  • /var/log/messages
• Service control: “The Service name is bind9 on Linux distribution Debian/Ubuntu.”
  • Stop Named / BIND Service: /etc/init.d/named stop
  • Start Named / BIND Service: /etc/init.d/named start
  • Restart Named / BIND Service: /etc/init.d/named restart
• Configuration:
  • /etc/named.conf

The MySQL service has different name on different Linx distribution

• mysqld on CentOS/RHEL 5 and 6
• mysql on Debian/Ubuntu
• mariadb on CentOS/RHEL 7

• Logs:
  • /var/log/mysqld.log
  • On CentOS/RHEL: cat /etc/my.cnf | grep log-error log-error=/var/log/mariadb/mariadb.log
  • On Debian/Ubuntu : cat /etc/mysql/my.cnf | grep log_error log_error = /var/log/mysql/error.log
• Service control: “DONT FORGET TO REPLACE THE SERVICE NAME DEPENDS ON LINUX DISTRIBUTION.”
  • Stop MySQL service : /etc/init.d/mysqld stop
  • Start MySQL service : /etc/init.d/mysqld start
  • Restart MySQL service : /etc/init.d/mysqld restart
• Configuration:
  • On CentOS/RHEL: /etc/my.cnf
  • On Debian/Ubuntu:/etc/mysql/my.cnf

• Logs:
  • /var/lib/pgsql/pgstartup.log
• Service control:
  • Stop PostgreSQL service : /etc/init.d/postgresql stop
  • Start PostgreSQL service : /etc/init.d/postgresql start
  • Restart PostgreSQL service : /etc/init.d/postgresql restart
• Configuration:
  • /var/lib/pgsql/data/postgresql.conf

• Logs:
  • Global Access and Error logs: /var/log/httpd/
  • Domain logs: /var/www/vhosts//logs
• Service control:
  • Stop Apache Service : /etc/init.d/httpd stop
  • Start Apache Service: /etc/init.d/httpd start
  • Restart Apache Service: /etc/init.d/httpd restart
• Configuration:
  • /etc/httpd/conf/httpd.conf
  • /etc/httpd/conf.d/zz010_psa_httpd.conf
• Important NOTE: The service name is apache2 on SuSE, Debian, and Ubuntu. The path to its logs is /var/log/apache2 and the path to the configs is /etc/apache2

What is Single Sign-On (SSO): Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials to access multiple applications. The service authenticates the end user for all the applications the user has been given rights to and eliminates further prompts when the user switches applications during the same session.

• Logs:
  • SSO Error log: /var/log/sw-cp-server/error_log
  • SSO log: /var/log/sso/sso.log
• Configuration:
  • /etc/sso/sso_config.ini
  • /etc/sw-cp-server/conf.d/sso.inc
• Important NOTE: The service name is apache2 on SuSE, Debian, and Ubuntu. The path to its logs is /var/log/apache2 and the path to the configs is /etc/apache2

• Logs:
  • Horde Error log : /var/log/psa-horde/psa-horde.log
• Configuration:
  • /etc/psa-webmail/horde/horde.conf
  • /etc/psa-webmail/horde/horde/conf.php

What is NGINX: NGINX is open source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. It started out as a web server designed for maximum performance and stability. In addition to its HTTP server capabilities, NGINX can also function as a proxy server for email (IMAP, POP3, and SMTP) and a reverse proxy and load balancer for HTTP, TCP, and UDP servers.

To disable nginx, go to “Tools & Settings >> Services Management” and stop nginx from there.

• Logs:
  • Error log: /var/log/nginx/error.log
  • Access log: /var/log/nginx/access.log
  • Domain logs: /var/www/vhosts//logs/proxy_access*_log
• Service control:
  • Stop NGINX service: /etc/init.d/nginx stop
  • Start NGINX service: /etc/init.d/nginx start
  • Restart NGINX service: /etc/init.d/nginx restart
• Configuration:
  • /etc/nginx/nginx.conf
  • /etc/nginx/conf.d/zz010_psa_nginx.conf

What is Dovecot: Dovecot is an open source IMAP and POP3 email server for Linux/UNIX-like systems, written with security primarily in mind. Dovecot is an excellent choice for both small and large installations. It’s fast, simple to set up, requires no special administration and it uses very little memory.

• Logs:
  • /usr/sbin/dovecot
• Service control:
  • Stop Dovecot service: /etc/rc.d/init.d/dovecot stop
  • Start Dovecot service: /etc/rc.d/init.d/dovecot start
  • Restart Dovecot service: /etc/rc.d/init.d/dovecot restart
• Configuration:
  • /etc/sysconfig/dovecot
  • /etc/dovecot/dovecot.conf
  • /etc/dovecot/conf.d/11-plesk-security-ssl.conf

• Logs:
  • Plesk Backup logs: /usr/local/psa/PMM/logs/backup-
  • Plesk Restore logs: /usr/local/psa/PMM/logs/restore-
• Configuration:
  • /etc/psa/psa.conf

• Logs:
  • /usr/local/psa/var/log/xferlog
  • /var/log/secure
• Configuration:
  • /etc/proftpd.conf
  • /etc/xinetd.d/ftp_psa
  • /etc/proftpd.include

• Logs:
  • /usr/local/psa/var/modules/panel-migrator/logs/
• Configuration:
  • /usr/local/psa/var/modules/panel-migrator/conf/
  • /usr/local/psa/admin/plib/modules/panel-migrator/backend/conf/

• Logs:
  • Roundcube Error log: /var/log/plesk-roundcube/errors
• Configuration:
  • /etc/psa-webmail/roundcube/*