app:web error_log
Web server error log
Server diagnostics: module and level, client IP, message. Apache LogLevel defaults to warn; nginx error_log defaults to error. Exploitation often leaves application errors here (PHP fatal errors, 404 bursts at info level).
- Log source
- Web server logs (Apache httpd, nginx, Tomcat, Traefik)
- Host type
- Other / unclassified
- How to enable
- Apache: ErrorLog logs/error_log; LogLevel warn (core:info restores 404 lines). nginx: error_log /var/log/nginx/error.log warn.
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Splunk 1, Elastic 4
Why this tier
CISA CM0106; DISA STIG (web)
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Recommended | CISA CM0106; DISA STIG (web) |
| Linux web server, internet-facing | Recommended | CISA CM0106; DISA STIG (web) |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| CISA: Web shell eviction countermeasureEviction Strategies Tool, CM0106 Eliminate Web Shells | Names this event | quoted: logs to preserve: error |
| DISA STIG: Web server logging requirementsApache Server 2.4 UNIX Server V3R3 (2026-05-28) and UNIX Site V2R7 | Names this event | AS24-U1-000630 (web): LogLevel info or below (ErrorLog) |