Re: nolog rule still logs

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Saturday, April 3rd, 2021 at 12:38 PM, Bren via mod-security-users <[email protected]> wrote:

> Even with nolog this rule still logs to the audit log and the Nginx error log.

So I think I know what's going on. This rule isn't actually being logged despite "nolog". I think it's the 403 itself that's being logged due to the default:

SecAuditLogRelevantStatus "^(?:5|4(?!04))"

If I set it to:

SecAuditLogRelevantStatus "^(?:5|4(?!04|03))"

It stops logging the 403s being generated by my health check rule. The comment on this rule says:

"Log the transactions that are marked by a rule, as well as those that trigger a server error..."

So I think this is working as designed since my rule is triggering a server error.

If I set my rule to "log" it still logs the rule match as expected showing the 403 response. OWASP CRS rule matches still get logged as well so I think this change will work for me.

Bren


_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/