Modsecurity Nginx: Audit log not being populated

Christian Varas <[email protected]>
Newsgroups gmane.comp.apache.mod-security.user
Message-ID <[email protected]>
Hello, I’ve conpiled a nginx and Modsecurity today, every works fine except the audit log. The audit log is not being populated, the attacks are logged only in the error log but not in the audit log.
If I change modsecurity to “DetectionOnly” the audit logs start to being populated but if I set modsecurity in “On” the audit log does not work…
This is my setup:

nginx version: 1.15.8.1
Modsecurity: branch v3/Master from GitHub

I have this lines to log the transactions:

SecRuleEngine On
SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"


SecAuditLogDirMode 1733
SecAuditLogFileMode 0550
SecAuditLogFormat JSON
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4)”
SecAuditLogParts ABCHIZ
SecAuditLogType Serial
SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log



Maybe I need to fix my configuration ?
Does anybody else is experimenting the same ?

Thanks in advanced.
Cheers.
Chris.

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/
signature.asc (application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE0eEJ8ISrg/NQng2PQkD5YQ78/BYFAl5C+uAACgkQQkD5YQ78
/BbmEQ//ZLRpqYifEXOvgeFRpCHD1pre48NQm2gqZWsMs09Q/9pX4F5spySDjXg1
NmVttw7rsk014zoXf0tqam9qU8sBafvgvkQYtDm0EtQCY1J+tD5bZrghgskl05I9
TBlUguVKKL6qJBZQoORKxYXu8r4hhzrkoq3mxJ6++YpqAlaCJo1i6bb2B3u4iun8
AFQ+G8TSV0TQm2M9F3OmYvW0LWwv0Rcf+Xd1XZCOkGKQmb/Rfd97bJux1z+Bw/Qt
fb+oEkewCp0SOT6ioa8rMoluyXZZCS5PH1fMZzzuLKzWSK14ggtMmSDkcy18ANkK
hPw03oUwWpphVFp8/C3aFzmhuJkwAQNjUEHLj9lSoqqbGwno1JCy8fei54CqMlID
4AKcxeDg9fa3AXAmiAsKdZ3drgYd5MU8bE4LHFzNKUWsDgn/3KbwMQK00r2bvAod
aOIMBN76vT5XAy8GC3uuCXG4RBIcXziNB7BGJ727lZRK8L/7YbTDtfJcnjVyHlgn
EXLV30KXVPuRGnegP/fTViq6l2TQDRYSWsZ4ZnG4JD24izmWOhOxSobiUyfLWSxW
s588rmvWI9ck+kQyeO1GjsDA2/8VcaVNpYUKA5o+9oiS55l2oiEqVqsvNdPV2KNh
FNCsDffhUhZ3h6mePgc+dPJJHMyQQ+6Fv5+KvnGmX4jcTYieIxw=
=sEsn
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.