# Fail2ban-friendly combined error log for all ISPConfig (or other multi-vhost) sites on this host.
#
# Install as: /etc/apache2/conf-available/fail2ban-error-log.conf, then `a2enconf fail2ban-error-log`.
#
# See apache-notes/apache-errorlogformat.md for the rationale, the open
# question this is meant to test, and the deployment/rollback procedure.
# Do not fold this into apache2.conf - it's a dpkg conffile and a future
# `apt upgrade apache2` can overwrite or discard edits made there.
#
# UNVERIFIED as of 2026-09-15: unlike CustomLog (proven - see
# other_vhosts_access.log, which really does capture every ISPConfig site's
# traffic even though each site also has its own CustomLog), it has not yet
# been confirmed that a main-server-scope ErrorLog behaves the same way -
# i.e. that it ALSO captures a vhost's errors when that vhost has its own
# ErrorLog (ISPConfig gives every site one). That is exactly what deploying
# this is meant to test before any filter gets rewritten against it.
#
# ErrorLogFormat has no per-target format argument the way CustomLog does
# (CustomLog takes "path format"; ErrorLog only takes "path" - the format is
# set separately by ErrorLogFormat, scoped to server-or-vhost context, not
# to one specific ErrorLog target). Setting it here, in the main server
# context, therefore also becomes the DEFAULT format for every vhost's own
# ErrorLog unless that vhost sets its own ErrorLogFormat - which ISPConfig's
# vhosts don't. Expect every per-site error.log to start showing this same
# format too, not just other_vhosts_error.log. The only new field is %v
# (the vhost name) - the rest mirrors Apache's traditional error-log look.

ErrorLogFormat "[%t] [%-m:%l] [pid %P] [client %a] %v: %M"
ErrorLog ${APACHE_LOG_DIR}/other_vhosts_error.log