Modsecurity 3 logging issues
Dino Edwards <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
I'm trying to get modsecurity to start logging audit events in JSON format so that I can import to ELK but I cannot get it to work. Here's the relevant config: SecAuditEngine on SecAuditLogRelevantStatus "^[0-9]+" SecAuditLogParts ABIJDEFHZ SecAuditLogType concurrent #SecAuditLog /var/log/modsec_audit.log SecAuditLogStorageDir /usr/local/nginx/logs/modsecurity/domain.tld After I reload nginx I don't see any files being generated in the /usr/local/nginx/logs/modsecurity/domain.tld directory. Can someone help point me in the right direction? Do I need to compile modsecurity with JSON support? If so, how would I go about doing that? I was under the impression that using SecAuditLogType concurrent would take care of it. Thanks in advance ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/