Getting Started

LiteSpeed website

Prepare LiteSpeed request logs and install the Honeylog sender over SSH.

Use this guide when the website runs on LiteSpeed. You need SSH access to the server and permission to edit its LiteSpeed configuration. If you do not manage the server, send this guide together with the private Honeylog installation page to your hosting provider or server administrator.

#Before you begin

The server must provide sudo, systemd, Python 3.9+ as python3, curl, and outbound HTTPS access. You also need the ingestion secret shown in Honeylog under Settings > Installation > LiteSpeed.

Honeylog also works with standard (Combined) access logs. We recommend the Honeylog format below for more complete request information. Standard logs retain IP, time, URL, method, status, bytes, referrer, and user agent. They omit the Host and browser-language headers, plus signals for background requests, navigation context, and prefetch/prerender activity.

#Step 1: Prepare LiteSpeed to record visits

  1. In Honeylog, open the website, go to Settings > Installation, and choose LiteSpeed.
  2. Enter the absolute path of a separate, uncompressed access log for this website.
  3. Copy the generated configuration into the website's accessLog block in OpenLiteSpeed. Keep the fields in the same order. For Enterprise or a hosting panel, ask your provider to apply the same log format.
  4. Save the configuration and apply your server or panel's graceful restart procedure.
  5. Open a public page and confirm that a new line appears in the log, including on a repeat visit served from cache.

Example OpenLiteSpeed configuration:

accessLog /usr/local/lsws/SITE_DOMAIN/logs/honeylog_access.log {
  useServer 0
  logFormat %h %l %u %t "%{Host}i" "%r" %>s %b "%{Referer}i" "%{User-Agent}i" "%{X-Requested-With}i" "%{Accept-Language}i" "%{Sec-Fetch-Dest}i" "%{Sec-Fetch-Mode}i" "%{Sec-Fetch-Site}i" "%{Sec-Fetch-User}i" "%{Sec-Purpose}i" "%{Purpose}i" "%{X-Moz}i" "%{Sec-Speculation-Tags}i"
  logReferer 1
  logUserAgent 1
  rollingSize 10M
  keepDays 30
  compressArchive 0
}

Replace the example path with the actual log path for your site, and use that same path in Honeylog. When changing the log format, write to a fresh file so old and new formats do not mix. Keep native log rotation enabled and rotated files uncompressed until collected; in OpenLiteSpeed, use compressArchive 0.

If you keep an existing Combined log, leave its format unchanged and use HONEYLOG_LOG_FORMAT='combined' in the install command instead of honeylog.

#Step 2: Install the Honeylog sender

  1. Save the log file path in the private Honeylog installation page.
  2. Generate the ingestion secret if one is not already present.
  3. Copy the generated install command and run it over SSH on the LiteSpeed server. The copied command includes your site's secret.
  4. Wait for the command to finish without errors.

Install script: Open install.sh

The public example below asks for the secret without displaying it. Replace SITE_DOMAIN with the domain selected in Honeylog and adjust the log path, or use the personalized command from Settings > Installation > LiteSpeed.

read -rsp "Honeylog ingestion secret: " HONEYLOG_INGESTION_SECRET
echo
export HONEYLOG_INGESTION_SECRET
export CLIENT_BASE_URL='https://api.honeylog.io/clients'
export HONEYLOG_API_URL='https://api.honeylog.io/events'
export HONEYLOG_SITE_DOMAIN='SITE_DOMAIN'
export HONEYLOG_LOG_PATH='/usr/local/lsws/SITE_DOMAIN/logs/honeylog_access.log'
export HONEYLOG_LOG_FORMAT='honeylog'
export HONEYLOG_BATCH_SIZE=100
export HONEYLOG_TIMEOUT_MS=10000
export HONEYLOG_POLL_INTERVAL_SECONDS=30

curl -fsSL "$CLIENT_BASE_URL/litespeed/install.sh" | bash

The installer checks the log before starting collection. The log must contain at least one request in the selected format. This installation configures one site per server; running it again replaces that site's configuration.

#Step 3: Verify the installation

Run these commands on the server:

sudo systemctl status honeylog-litespeed.service --no-pager
sudo journalctl -u honeylog-litespeed.service -n 100 --no-pager

The service should show active (running). Open a few public pages on the website, wait about one minute, and check Raw Logs in Honeylog for the new visits.

If the service is not active or visits do not appear, send the command output to your server administrator or Honeylog support, without including your ingestion secret.