---
title: "Return ModSecurity logs"
method: GET
path: "/modsec_get_log"
tags: ["ModSecurity", "Server Settings"]
---

# Return ModSecurity logs

`GET /modsec_get_log`

This function retrieves ModSecurity™ log entries from the modsec MySQL® database.

**Important:**

When you disable the
[Web Server role](https://docs.cpanel.net/knowledge-base/general-systems-administration/how-to-use-server-profiles/#roles),
the system disables this function.

## Response `200`

HTTP Request was successful.

- object
  - `data` object[] — An array of objects that contains information about the log entry.
    - `action_desc` string — The web server's response to the client.
    - `file_exists` 1 | 0 — Whether the file in the `meta_file` return exists. * `1` — The file exists. * `0` — The files does **not** exist.
    - `handler` string, nullable — This parameter **only** returns the `null` value.
    - `host` string — The virtual host's (vhost) domain name.
    - `http_method` string — The [HTTP method](http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html) that the client used to generate the hit.
    - `http_status` integer — The [HTTP status code](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html) that the web server returned.
    - `http_version` string — The HTTP version number.
    - `id` integer — The line number from the `modsec` database.
    - `ip` string, ipv4 — The client's IP address.
    - `justification` string — The specific criteria from the ModSecurity rule that generated the hit.
    - `meta_file` string — The ModSecurity configuration file with the rule that triggered the log entry.
    - `meta_id` integer — The ID of the ModSecurity rule that triggered the log entry.
    - `meta_line` integer — The ModSecurity rule's line number that triggered the log entry.
    - `meta_logdata` string, nullable — The transaction data fragment from the ModSecurity rule's logdata action.
    - `meta_msg` string — The human-readable message from the ModSecurity rule's `msg` action.
    - `meta_offset` integer — The byte offset at which a match occurred within the target data. **Note:** This data is not always available.
    - `meta_rev` integer, nullable — The revision number from the ModSecurity rule's `rev` action.
    - `meta_severity` string, nullable — The hit severity level from the ModSecurity rule's `severity` action.
    - `meta_uri` string, uri, nullable — The client-requested URI. **Note:** This data is not always available.
    - `path` string — The accessed file's absolute path and filename.
    - `reportable` 1 | 0 — Whether the system can report the rule to the vendor. * `1` — Report the rule to the vendor. * `0` — Do **not** report the rule to the vendor. **Note:** The vendor **must** have configured a report URL in order to report a rule.
    - `timestamp` string, ISO-8601 Date Time — When the system recorded the log entry, in `YYYY-MM-DD HH:mm:SS` format. **Note:** This value uses the server's configured time zone.
    - `timezone` integer — The server's configured timezone, in minutes difference UTC/GMT format.
  - `metadata` object
    - `command` string — The method name called.
    - `reason` string — The reason the API function failed when the `metadata.result` field is `0`. This field may display a success message when a function succeeds.
    - `result` 1 | 0 — * `1` — Success. * `0` — Failed. Check the `reason` field for more details.
    - `version` integer — The version of the API function.

---

[API](https://skmtc.net/cpanel/apis/whm-api.md) · [All operations](https://skmtc.net/cpanel/apis/whm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cpanel/whm-api/revisions/3da41671c02c/schema)