### LiteSpeed Web Server Users' Manual

##### Version 5.0 Rev. 1

- License Std / Ent
- Introduction
- Installation
- Administration
  - Service Manager
- Security
- Configuration
  - Server General
  - Server Tuning
  - Server Security
  - Request Filter
  - Page Cache
  - External Apps
  - Fast CGI App
  - Fast CGI Authorizer
  - LSAPI App
  - Servlet Engine
  - Web Server
  - Pipped logger
  - Load Balancer
  - Script Handler
  - Rack/Rails Settings
  - Listeners
  - Templates
  - Virtual Host Basic
  - Virtual Host General
  - Virtual Host Security
  - Rewrite
  - Context
  - Static Context
  - Java Web App Context
  - Servlet Context
  - Fast CGI Context
  - LSAPI Context
  - Proxy Context
  - CGI Context
  - Load Balancer Context
  - Redirect Context
  - Rack/Rails Context
  - Web Socket Proxy
  - Add-ons
  - Admin Server
  - Admin Listeners

# Administration Console Settings

Admin Server is a special virtual host dedicated to the WebAdmin console. It is very important to make sure Admin Server is securely protected either by only allowing access from the administrator's machines or by using an encrypted SSL connection.

#### Table of Contents

Enable Core Dump
Description: Specifies whether to enable core dump when the server is started by "root" user. For most modern Unix systems, processes that change user ID or group ID are not allowed to dump a core file for security reasons. However, it is much easier to identify root cause of a problem with a core dump. This option only works on Linux kernel 2.4 and up. Solaris users should use the coreadm command to control this feature.
Syntax: Select from radio box
Tips: [Security] Only enable this when you see no core file created in the server log file. Disable it immediately after producing the core file. Please submit a bug report when a core dump has been created.

Session Timeout (secs)
Description: Customize the session timeout length of WebAdmin console. The default is 60 seconds if no value is set.
Syntax: Integer number
Tips: [Security] Set a proper value for production use, usually less than 300 seconds.

Use Server's Log
Description: Specifies whether to put log messages from this virtual host into the server log file instead of creating its own log file.
Syntax: Select from radio box

File Name
Description: Specifies the path for the log file.
Syntax: File name which can be absolute, or relative to $SERVER_ROOT, or relative to $VH_ROOT.
Tips: [Performance] Place the log file on a separate disk.

Log Level
Description: Specifies the level of logging. Available levels (from high to low) are ERROR, WARNING, NOTICE, INFO, and DEBUG. Only messages with a level higher than or equal to the current setting will be logged. If you want to set it to DEBUG, you must set the server log level to DEBUG as well. The level of debugging is controlled solely at the server level by Debug Level.
Syntax: Select from drop down list
Tips: [Performance] Unless Debug Level is set to a level other than NONE, DEBUG log level does not have any performance impact and is recommended.
See Also: Debug Level

Rolling Size (bytes)
Description: Specifies when the current log file needs to be rolled over, also known as log rotation. When the file size is over the rollover limit, the active log file will be renamed to log_name.mm_dd_yyyy(.sequence) in the same directory and a new active log file will be created. The actual size of the rotated log file once it is created will sometimes be a little bigger than this size limit. Set to 0 to disable log rotation.
Syntax: Integer number
Tips: Append "K", "M", "G" to the number for kilo-, mega- and giga- bytes.

Log Control
Description: Specifies where to write the access log. There are three options: 1. Write to the server's access log 2. Create an access log for this virtual host 3. Disable access logging.
Syntax: Select from drop down list

File Name
Description: Specifies the file name of the access log file.
Syntax: File name which can be absolute, or relative to $SERVER_ROOT, or relative to $VH_ROOT.
Tips: [Performance] Put access log file on a separate disk.

Piped Logger
Description: Specifies the external application that will receive the access log data sent by LiteSpeed through a pipe on its STDIN stream (file handle is 0). When this field is specified, the access log will be sent only to the logger application and not the access log file specified in previous entry. The logger application must be defined in External Application section first. Server-level access logging can only use an external logger application defined at the server level. Virtual host-level access logging can only use a logger application defined at the virtual host level. The logger process is spawned in the same way as other external (CGI/FastCGI/LSAPI) processes. This means it will execute as the user ID specified in the virtual host's ExtApp Set UID Mode settings and will never run on behalf of a privileged user. LiteSpeed web server performs simple load balancing among multiple logger applications if more than one instance of a logger application is configured. LiteSpeed server always attempts to keep the number of logger applications as low as possible. Only when one logger application fails to process access log entries in time will the server attempt to spawn another instance of the logger application. If a logger crashes, the web server will start another instance but the log data in the stream buffer will be lost. It is possible to lose log data if external loggers cannot keep up with the speed and volume of the log stream.
Syntax: Select from drop down list

Log Format
Description: Enterprise Edition Only Specifies the log format for the access log. When log format is set, it will override the Log Headers setting.
Syntax: String. The syntax of log format is compatible with Apache 2.0's custom log format.
Example: Common Log Format (CLF) "%h %l %u %t \"%r\" %>s %b" Common Log Format with Virtual Host "%v %h %l %u %t \"%r\" %>s %b" NCSA extended/combined log format "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" Log cookie value of Foobar "%{Foobar}C"
See Also: Log Headers

Log Headers
Description: Specifies whether to log HTTP request headers: Referer, UserAgent, and Host.
Syntax: Select from checkbox
Tips: [Performance] Turn this off if you do not need these headers in the access log.
See Also: Log Format

Keep Days
Description: Specifies how many days the access log file will be kept on disk. Only rotated log files older than specified number of days will be deleted. The current log file will not be touched regardless how many days' data it contains. If you do not want to auto-delete stale and very old log files, set this value to 0.
Syntax: Integer number

Bytes Log
Description: Specifies the path to the bandwidth bytes log file. When specified, a cPanel compatible bandwidth log will be created. This will log the total bytes transferred for a request including both the request and reply body.
Syntax: File name which can be an absolute path or relative to $SERVER_ROOT.
Tips: [Performance] Put the log file on a separate disk.

Compress Archive
Description: Specifies whether to compress rotated log files in order to save disk space.
Syntax: Select from radio box
Tips: Log files are highly compressible and this is recommended to reduce disk usage for old logs.

Access Control
Description: Specifies what sub networks and/or IP addresses can access the server. At the server-level, this setting will affect all virtual hosts. You can also set up access control unique to each virtual host at the virtual host-level. Virtual host settings will NOT override server settings. Whether to block/allow an IP is determined by the combination of the allowed list and the denied list. If you want to block only certain IPs or sub-networks, put * or ALL in the Allowed List and list the blocked IPs or sub-networks in the Denied List. If you want to only allow certain IPs or sub-networks, put * or ALL in the Denied List and list the allowed IPs or sub-networks in the Allowed List. The setting of the smallest scope that fits for an IP will be used to determine whether to block or allow that IP. Server-level: Trusted IPs or sub-networks must be specified in the Allowed List by adding a trailing "T". Trusted IPs or sub-networks are not affected by connection/throttling limits. Only server-level access control can set up trusted IPs/sub-networks.
Tips: [Security] Use this at the server-level for general restrictions that apply to all virtual hosts.

Allowed List
Description: Specifies the list of IPs or sub-networks allowed. * or ALL are accepted.
Syntax: Comma delimited list of IP addresses or sub-networks. A trailing "T" can be used to indicate a trusted IP or sub-network, such as 192.168.1.*T.
Example: Sub-networks: 192.168.1.0/255.255.255.0, 192.168.1.0/24, 192.168.1 or 192.168.1.*. IPv6 addresses: ::1 or [::1] IPv6 subnets: 3ffe:302:11:2:20f:1fff:fe29:717c/64 or [3ffe:302:11:2:20f:1fff:fe29:717c]/64.
Tips: [Security] Trusted IPs or sub-networks set at the server-level access control will be excluded from connection/throttling limits.

Denied List
Description: Specifies the list of IPs or sub-networks disallowed.
Syntax: Comma delimited list of IP addresses or sub-networks. * or ALL are accepted.
Example: Sub-networks: 192.168.1.0/255.255.255.0, 192.168.1.0/24, 192.168.1 or 192.168.1.*. IPv6 addresses: ::1 or [::1] IPv6 subnets: 3ffe:302:11:2:20f:1fff:fe29:717c/64 or [3ffe:302:11:2:20f:1fff:fe29:717c]/64.

Web Admin User
Description: Change the username and password for WebAdmin Console. The old password has to be entered and verified in order to save changes.