You’re on the right track. Here’s the complete procedure, with a few details added to avoid common pitfalls.
Why the traffic is missing
Your IP is being accessed directly (via IP, not domain), so Nginx routes it to the default server block, which is configured with:
access_log off;
error_log /dev/null;
That’s why nothing shows up in your domain logs. The request never reaches a domain vhost.
In HestiaCP, the default vhost is defined in:
/etc/nginx/conf.d/<YOUR_PUBLIC_IP>.conf
Full default vhost config (before)
This is what the file typically looks like. Note the access_log off; and error_log /dev/null; in both server blocks:
server {
listen <YOUR_PUBLIC_IP>:80 default_server;
server_name _;
access_log off;
error_log /dev/null;
location / {
proxy_pass http://<YOUR_PUBLIC_IP>:8080;
}
}
server {
listen <YOUR_PUBLIC_IP>:443 default_server ssl;
server_name _;
access_log off;
error_log /dev/null;
ssl_certificate /usr/local/hestia/ssl/certificate.crt;
ssl_certificate_key /usr/local/hestia/ssl/certificate.key;
return 301 http://$host$request_uri;
location / {
root /var/www/document_errors/;
}
location /error/ {
alias /var/www/document_errors/;
}
}
Full default vhost config (after — with logging enabled)
Change the access_log and error_log lines in both server blocks:
server {
listen <YOUR_PUBLIC_IP>:80 default_server;
server_name _;
access_log /var/log/apache2/domains/default_access.log combined;
error_log /var/log/apache2/domains/default_error.log error;
location / {
proxy_pass http://<YOUR_PUBLIC_IP>:8080;
}
}
server {
listen <YOUR_PUBLIC_IP>:443 default_server ssl;
server_name _;
access_log /var/log/apache2/domains/default_access.log combined;
error_log /var/log/apache2/domains/default_error.log error;
ssl_certificate /usr/local/hestia/ssl/certificate.crt;
ssl_certificate_key /usr/local/hestia/ssl/certificate.key;
return 301 http://$host$request_uri;
location / {
root /var/www/document_errors/;
}
location /error/ {
alias /var/www/document_errors/;
}
}
Note: In HestiaCP, Nginx and Apache share the /var/log/apache2/domains/ directory, so this path is correct.
ls -ld /var/log/apache2/domains/
Step 1 — Back up the config
cp /etc/nginx/conf.d/<YOUR_PUBLIC_IP>.conf /etc/nginx/conf.d/<YOUR_PUBLIC_IP>.conf.bak
Step 2 — Enable logging on the default vhost
Edit:
vi /etc/nginx/conf.d/<YOUR_PUBLIC_IP>.conf
Apply the “after” version shown above.
Step 3 — Test and reload
nginx -t && systemctl reload nginx
Only reload if nginx -t reports syntax is ok and test is successful.
Step 4 — Watch the traffic
tail -f /var/log/apache2/domains/default_access.log
To filter for the malicious IP:
tail -f /var/log/apache2/domains/default_access.log | grep 193.32.204.199
You can also watch the error log:
tail -f /var/log/apache2/domains/default_error.log
Step 5 — Restore when done
Once you’ve captured enough, restore the backup:
cp /etc/nginx/conf.d/<YOUR_PUBLIC_IP>.conf.bak /etc/nginx/conf.d/<YOUR_PUBLIC_IP>.conf
nginx -t && systemctl reload nginx
This puts access_log off; and error_log /dev/null; back, so the log doesn’t grow indefinitely from scanner noise.
Optional — Block the IP at the firewall
If you just want it gone, you can drop it at the firewall level instead of logging:
# nftables
nft add rule inet filter input ip saddr 193.32.204.199 drop
# or iptables
iptables -I INPUT -s 193.32.204.199 -j DROP
For repeated scanners, fail2ban is a better long-term solution.
Summary
- IP-direct traffic goes to the default vhost, which has logging disabled.
- Temporarily enable
access_log / error_log there.
nginx -t && systemctl reload nginxtail -f the new log to catch the scanner.- Restore the backup when done.
.