1# You can leave the default apache2 path in acquis.yaml as it will deal with your server logs
2# this extra acquisition is for apache2 errors for your various users domains 
3## put in /etc/crowdsec/acquis.d/apache2whm.yaml 
4filenames: 
5  - /var/log/apache2/domlogs/*
6exclude_regexps:
7  - .*ftpxferlog.*
8  # you can excluse other regexp that are not apache2 log files
9labels:
10  type: apache2

1# ftpxfer typical WHM override : 
2## put in /etc/crowdsec/acquis.d/ftpxfer.yaml 
3filenames: 
4  - /usr/local/apache2/domlogs/ftpxferlog
5labels:
6  type: syslog
7  # depending on your ftp service the type can also be proftpd or vsftpd

1# cpanel typical WHM override : 
2## put in /etc/crowdsec/acquis.d/cpanel.yaml 
3## and comment out cpanel acquis default config in /etc/crowdsec/acquis.yaml if necessary
4filenames: 
5  - /usr/local/cpanel/logs/login_log
6  - /usr/local/cpanel/logs/error_log
7  - /usr/local/cpanel/logs/access_log
8labels:
9  type: cpanel

1# ConfigServer LFD path : 
2## put in /etc/crowdsec/acquis.d/configserver-lfd.yaml 
3filenames: 
4  - /var/log/lfd.log
5labels:
6  type: syslog

1# In case your Dovecot logs into syslog
2# syslog will likely route mail logs to maillog
3## put in /etc/crowdsec/acquis.d/dovecot.yaml 
4## and comment out cpanel aqcuis default config in /etc/crowdsec/acquis.yaml if necessary
5## depending on your OS the file might be /var/log/maillog or /var/log/mail.log
6filenames: 
7  - /var/log/maillog
8labels:
9  type: syslog