Modsecurity Nginx: Audit log not being populated
Christian Varas <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
Hello, I’ve conpiled a nginx and Modsecurity today, every works fine except the audit log. The audit log is not being populated, the attacks are logged only in the error log but not in the audit log. If I change modsecurity to “DetectionOnly” the audit logs start to being populated but if I set modsecurity in “On” the audit log does not work… This is my setup: nginx version: 1.15.8.1 Modsecurity: branch v3/Master from GitHub I have this lines to log the transactions: SecRuleEngine On SecDefaultAction "phase:1,log,auditlog,deny,status:403" SecDefaultAction "phase:2,log,auditlog,deny,status:403" SecAuditLogDirMode 1733 SecAuditLogFileMode 0550 SecAuditLogFormat JSON SecAuditEngine RelevantOnly SecAuditLogRelevantStatus "^(?:5|4)” SecAuditLogParts ABCHIZ SecAuditLogType Serial SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log Maybe I need to fix my configuration ? Does anybody else is experimenting the same ? Thanks in advanced. Cheers. Chris. _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/
signature.asc
(application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE0eEJ8ISrg/NQng2PQkD5YQ78/BYFAl5C+uAACgkQQkD5YQ78 /BbmEQ//ZLRpqYifEXOvgeFRpCHD1pre48NQm2gqZWsMs09Q/9pX4F5spySDjXg1 NmVttw7rsk014zoXf0tqam9qU8sBafvgvkQYtDm0EtQCY1J+tD5bZrghgskl05I9 TBlUguVKKL6qJBZQoORKxYXu8r4hhzrkoq3mxJ6++YpqAlaCJo1i6bb2B3u4iun8 AFQ+G8TSV0TQm2M9F3OmYvW0LWwv0Rcf+Xd1XZCOkGKQmb/Rfd97bJux1z+Bw/Qt fb+oEkewCp0SOT6ioa8rMoluyXZZCS5PH1fMZzzuLKzWSK14ggtMmSDkcy18ANkK hPw03oUwWpphVFp8/C3aFzmhuJkwAQNjUEHLj9lSoqqbGwno1JCy8fei54CqMlID 4AKcxeDg9fa3AXAmiAsKdZ3drgYd5MU8bE4LHFzNKUWsDgn/3KbwMQK00r2bvAod aOIMBN76vT5XAy8GC3uuCXG4RBIcXziNB7BGJ727lZRK8L/7YbTDtfJcnjVyHlgn EXLV30KXVPuRGnegP/fTViq6l2TQDRYSWsZ4ZnG4JD24izmWOhOxSobiUyfLWSxW s588rmvWI9ck+kQyeO1GjsDA2/8VcaVNpYUKA5o+9oiS55l2oiEqVqsvNdPV2KNh FNCsDffhUhZ3h6mePgc+dPJJHMyQQ+6Fv5+KvnGmX4jcTYieIxw= =sEsn -----END PGP SIGNATURE-----