If you’re managing a cPanel server, you might come across a situation where the modsec.sqlite file located at /var/cpanel/modsec/ becomes excessively large. This file stores logs from ModSecurity, and without proper maintenance, it can take up a lot of disk space, affecting the server’s performance. If you’re wondering how to fix the modsec.sqlite file size issue in cPanel, regular maintenance and log management are essential to prevent it from growing too large.

In this blog, we’ll walk through a step-by-step process to clean up the modsec.sqlite file, recreate it safely.

ModSecurity logs every web request that triggers its rules into the modsec.sqlite database. While this is useful for monitoring, the file can grow uncontrollably if left unchecked, sometimes exceeding tens or hundreds of GBs. This growth can lead to:

• Reduced available disk space.
• Increased backup sizes and times.
• Potential performance degradation.

Step-by-Step Solution to fix modsec.sqlite file size issue in cPanel

Step 1: Stop the tailwatchd Service

The tailwatchd service actively monitors logs and might lock the modsec.sqlite file. Before making any changes, stop this service:

/scripts/restartsrv_tailwatchd --stop

This ensures the database is not in use during the cleanup process.

Step 2: Backup the Current Database

Before proceeding, create a backup of the existing database. This allows you to restore it if needed:

mv /var/cpanel/modsec/modsec.sqlite /var/cpanel/modsec/modsec.sqlite.old1

This command renames the file, effectively removing it from active use while preserving its content.

Step 3: Recreate a Fresh Database

Generate a new, empty modsec.sqlite database with the following command:

/scripts/setup_modsec_db

This initializes a clean database for ModSecurity, ensuring that logs start fresh.

Step 4: Restart the tailwatchd Service

Once the new database is set up, restart the tailwatchd service to resume normal operations:

/scripts/restartsrv_tailwatchd --start

This brings ModSecurity logging back online, now utilizing the clean database.

Managing the size of the modsec.sqlite file is essential to maintaining a healthy cPanel server. Following these steps, you can safely clean up the database, recreate it, and implement preventive measures to avoid future issues.

If you need assistance with How to fix modsec.sqlite file size issue in cPanel, contacting the Skynats for support can provide valuable guidance.