nolog rule still logs
Bren via mod-security-users <[email protected]> Sat, 03 Apr 2021 17:38:27 +0000
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <XLkfTWm2v9ppZGbvP25u-WtTKqLpmvX7wx7euZuKw9sASA5QXtnuA_j4HdC2jftCBMTZQBPHfVK8XWray0LUZqRx8qD79QccZscM9MQOX-s=@protonmail.com> |
Hello, I've been working to roll out ModSecurity on Nginx (OpenResty 1.19.3.1 / nginx-1.19.3). I compiled the Nginx connector against the Debian 10 version of libmodsecurity (v3.0.3, but this happens when using v3/master as well). Using the stock unmodified modsecurity.conf-recommended. I added this line for haproxy health checks: SecRule REQUEST_FILENAME "/waf_health_check" "id:1000,nolog,deny" Even with nolog this rule still logs to the audit log and the Nginx error log. I've tried every combo of options I could find to get this to stop logging but for some reason it still gets logged. As far as I can tell from the docs, nolog should prevent this rule match from appearing in any logs. I shouldn't need anything else but this. What am I missing? Bren _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/