If like me, you installed ModSecurity on Ubuntu or a Debian machine with something like $ sudo apt-get install libapache2-mod-security2 , we might end up clueless trying to find the mod_security.c file (as suggested in a few places) because the LoadModule in the Apache config uses a .so file.

But whether you're using Ubuntu, Debian or CentOS, there is an easy way to figure out the version number. Use the logs, Luke!

Everytime, we restart the server, ModSecurity does us the courtesy of throwing out a bunch of info in the logs. Along with the ModSecurity version info, it will provide you with version info about each of the major components it uses - APR, PCRE, Lua, libXML :)

$ sudo service apache2 restart

$ grep -i modsecurity /var/log/apache2/error.log

[Sun Mar 08 08:14:02.000210 2015] [:notice] [pid 1912] ModSecurity for Apache/2.7.7 (http://www.modsecurity.org/) configured.
[Sun Mar 08 08:14:02.000278 2015] [:notice] [pid 1912] ModSecurity: APR compiled version="1.5.1-dev"; loaded version="1.5.1-dev"
[Sun Mar 08 08:14:02.000290 2015] [:notice] [pid 1912] ModSecurity: PCRE compiled version="8.31 "; loaded version="8.31 2012-07-06"
[Sun Mar 08 08:14:02.000300 2015] [:notice] [pid 1912] ModSecurity: LUA compiled version="Lua 5.1"
[Sun Mar 08 08:14:02.000308 2015] [:notice] [pid 1912] ModSecurity: LIBXML compiled version="2.9.1"