Re: Use of Modsec variable in apache access log
homesh joshi <[email protected]> Wed, 21 Jun 2023 17:45:42 +0530
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <CAAjxK7t4zFHDiQy93RtB=gObTifc9F5ckpN138Wmh5kW78ZMPw@mail.gmail.com> |
--===============8658854852609852356== Content-Type: multipart/alternative; boundary="000000000000b6264705fea2ba7c" --000000000000b6264705fea2ba7c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Christian, Thanks for the quick reply. OK so in detectonly mode also modsecurity rule evaluation works the same. Debug is a good idea. I have UAT so I can test. Will let you know. Thanks, Homesh On Wed, Jun 21, 2023 at 3:03=E2=80=AFPM Christian Folini < [email protected]> wrote: > Hey Homesh, > > Evaluation does indeed stop after a drop and there is a chance > your rules only set the variables in question in a later phase. > Really depends on your configuration. > > You can follow rule execution with the ModSecurity debug log, but beware > it is very verbose. > > Generally, it is best to set variables for display in the access log only > in phase 5, which is also executed for requests that have been denied > in an earlier phase. > > Best regards, > > Christian > > > > > On Wed, Jun 21, 2023 at 01:14:04PM +0530, homesh joshi wrote: > > Hi All, > > > > With regards to my approach for logging the modsec variables in apache > log > > has worked for me for almost a year now. > > However, today when I enabled "SecRuleEngine DetectionOnly" for one of = my > > websites. What I notice is that the apache logs are missing the right > > variable data. > > e.g I tested SQL injection and i was not able to see the relevant > > information in apache log which I typically get when "SecRuleEngine On" > > sample log for "SecRuleEngine DetectionOnly" > > 49.36.106.185 - - [21/Jun/2023:06:39:53 +0000] 200 23125 GET "-" > > "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 > > Firefox/114.0" 3154 443 example.com ZJKbOUfg7dWT82qCkvNySAAAAEU TLSv1.3 > > TLS_AES_128_GCM_SHA256 0 4 L; "/" 15.24.15.205 39735 "" "" "" "/" 33376= 2 > > "/?k=3D1%20or%201=3D1" > > > > here rule id log is 333762 which is not the signature for SQL injection > > > > So my conclusion is, in "SecRuleEngine On" rule evaluation stops when t= he > > first rule matches with the final action drop/block. Hence I am able to > get > > the right rule ID and other variable data. But when "SecRuleEngine > > DetectionOnly" rule evaluation continues till the last rule and due to > > which my variable data gets changed as per the rules getting evaluated. > Can > > I change this behaviour of modsecurity in Detectonly mode ? that it > should > > stop the evaluation when it matches the first rule with final action of > > drop/block ( and not block/drop the transaction) ? > > > > Please suggest. > > > > Thanks, > > Homesh > > > > > > On Fri, Mar 25, 2022 at 4:08=E2=80=AFPM Christian Folini < > > [email protected]> wrote: > > > > > Thanks for the updates. I do not immediately see why it's not working > > > completely. But glad you have a working solution. > > > > > > Best, > > > > > > Christian > > > > > > On Fri, Mar 25, 2022 at 01:59:38PM +0530, homesh joshi wrote: > > > > Dear Christian, > > > > > > > > I added setvar:tx.rule=3D1 in each rule and then added the followin= g > rule, > > > > post which I am able to get 1 written in access logs ( via the > %{waf} ) > > > for > > > > the transactions which got blocked by Modsec. for other transaction= s > it > > > is > > > > missing and hence getting - in the logs. I was not able to directly > set > > > the > > > > WAF=3D1 in the rules via setenv:waf=3D1 > > > > > > > > SecRule TX:rule "@eq 1" "phase:5,pass,setenv:waf=3D1,id:'9001'" > > > > > > > > Will test this any update incase I face any challenge. > > > > > > > > Thanks, > > > > Homesh > > > > > > > > > > > > On Thu, Mar 24, 2022 at 6:35 PM Christian Folini < > > > > [email protected]> wrote: > > > > > > > > > I suggest you add this to every rule that detects / blocks > something. > > > > > Thus not a SecAction, but attach the setenv to your existing > SecRules > > > > > where you want to see the flag. > > > > > > > > > > Alternatively, you can do a SecRule in phase 5 where you test the > > > > > HTTP status and if it's 403, then you set the env. > > > > > > > > > > Good luck! > > > > > > > > > > Christian > > > > > > > > > > On Thu, Mar 24, 2022 at 05:02:20PM +0530, homesh joshi wrote: > > > > > > Dear Christian, > > > > > > > > > > > > Thanks. I think this will work for me. However, can you please > > > explain > > > > > it a > > > > > > bit more on how this works. > > > > > > from your tutorial if i set up following rule > > > > > > > > > > > > # =3D=3D=3D ModSec performance calculations and variable export= (ids: > > > 90100 - > > > > > 90199) > > > > > > > > > > > > SecAction "id:90100,phase:5,pass,nolog,setenv:modsec=3D1" > > > > > > > > > > > > then for every access I see "1" in the access log. > > > > > > > > > > > > I think I will need to understand it more in order to use it. > > > > > > > > > > > > Kindly explain > > > > > > 1) the configuration required for setenv by modifying each rule > > > > > > > > > > > > 2) the configuration required for more complicated scheme which > you > > > > > > are referring to > > > > > > > > > > > > Thanks, > > > > > > > > > > > > Homesh > > > > > > > > > > > > > > > > > > On Thu, Mar 24, 2022 at 11:52 AM Christian Folini < > > > > > > [email protected]> wrote: > > > > > > > > > > > > > Hi there, > > > > > > > > > > > > > > On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi wrote: > > > > > > > > Thanks for the clarification. > > > > > > > > I have already gone through excellent netnea.com tutorials. > I > > > have > > > > > > > already > > > > > > > > used some of the configuration from tutorial.I do not use > crs. > > > > > > > > > > > > > > Thank you very much. > > > > > > > > > > > > > > > My objective here is that I want to get a flag in access lo= g > > > line if > > > > > > > modsec > > > > > > > > has taken any action on the transaction say simply it can b= e > a > > > field > > > > > like > > > > > > > > modsec=3D1 or modsec=3D0. This wi help me in separating > transactions > > > > > which > > > > > > > are > > > > > > > > allowed.(modsec=3D0) So then it is easy to show these > transactions > > > in > > > > > the > > > > > > > > reporting system. > > > > > > > > > > > > > > I'd do a setenv then in the rules. > > > > > > > > > > > > > > ... "setenv:modsec=3D1" > > > > > > > > > > > > > > Similar to the way I set th various env variables in phase 5. > You > > > can > > > > > > > simply > > > > > > > add this to every rule you have. Or you set up a more > complicated > > > > > scheme > > > > > > > and do it in the end in phase 5. > > > > > > > > > > > > > > Best, > > > > > > > > > > > > > > Christian > > > > > > > > > > > > > > > > > > > > > > > Kindly suggest. > > > > > > > > > > > > > > > > Thanks, > > > > > > > > Homesh > > > > > > > > > > > > > > > > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, < > > > > > > > > [email protected]> wrote: > > > > > > > > > > > > > > > > > HelloHomesh, > > > > > > > > > > > > > > > > > > Unfortunately, this is not how this works. > > > > > > > > > > > > > > > > > > A ModSecuriy variable is not automatically an environment > > > variable. > > > > > > > > > And on top, the ModSec variable "rule" is only available > > > during the > > > > > > > > > execution of the very rule (and there might be many, many > > > rules). > > > > > > > > > > > > > > > > > > I suggest you read up on my free tutorials published at > > > netnea.com > > > > > . > > > > > > > > > The one on logging and the ones on the Core Rule Set are > > > proposing > > > > > > > > > ways to achieve something along these lines. > > > > > > > > > > > > > > > > > > Best, > > > > > > > > > > > > > > > > > > Christian > > > > > > > > > > > > > > > > > > > > > > > > > > > On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi > wrote: > > > > > > > > > > Hi All, > > > > > > > > > > > > > > > > > > > > Hope you all are well. > > > > > > > > > > > > > > > > > > > > I want to add the modsecurity variable e.g "rule.id"in > the > > > > > apache > > > > > > > access > > > > > > > > > > log via the extended format. > > > > > > > > > > I set the following line in /etc/apache2/apache.conf > > > > > > > > > > > > > > > > > > > > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" > > > > > > > \"%{User-Agent}i\" > > > > > > > > > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended > > > > > > > > > > > > > > > > > > > > However I am not getting the rule.id value in the > access log > > > > > line. > > > > > > > > > > > > > > > > > > > > Kindly suggest. > > > > > > > > > > > > > > > > > > > > Thanks, > > > > > > > > > > Homesh > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > > > mod-security-users mailing list > > > > > > > > > > [email protected] > > > > > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > > > > > Commercial ModSecurity Rules and Support from Trustwave= 's > > > > > SpiderLabs: > > > > > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > > mod-security-users mailing list > > > > > > > > > [email protected] > > > > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > > > > Commercial ModSecurity Rules and Support from Trustwave's > > > > > SpiderLabs: > > > > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > mod-security-users mailing list > > > > > > > > [email protected] > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > > > Commercial ModSecurity Rules and Support from Trustwave's > > > SpiderLabs: > > > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > mod-security-users mailing list > > > > > > > [email protected] > > > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > > Commercial ModSecurity Rules and Support from Trustwave's > > > SpiderLabs: > > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > mod-security-users mailing list > > > > > > [email protected] > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > Commercial ModSecurity Rules and Support from Trustwave's > SpiderLabs: > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > mod-security-users mailing list > > > > > [email protected] > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > Commercial ModSecurity Rules and Support from Trustwave's > SpiderLabs: > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > _______________________________________________ > > > > mod-security-users mailing list > > > > [email protected] > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLab= s: > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > _______________________________________________ > > > mod-security-users mailing list > > > [email protected] > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > > http://www.modsecurity.org/projects/commercial/rules/ > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > _______________________________________________ > > mod-security-users mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > http://www.modsecurity.org/projects/commercial/rules/ > > http://www.modsecurity.org/projects/commercial/support/ > > > > _______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > --000000000000b6264705fea2ba7c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Hi Christian,</div><div><br></div><div>Thanks for the= quick reply. OK so in detectonly mode also modsecurity rule evaluation wor= ks the same.</div><div>Debug is a good idea. I have UAT so I can test. Will= let you know.</div><div><br></div><div>Thanks,</div><div>Homesh<br></div><= /div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">O= n Wed, Jun 21, 2023 at 3:03=E2=80=AFPM Christian Folini <<a href=3D"mail= to:[email protected]">[email protected]</a>> wrote:<= br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e= x;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hey Homesh,<br> <br> Evaluation does indeed stop after a drop and there is a chance<br> your rules only set the variables in question in a later phase.<br> Really depends on your configuration.<br> <br> You can follow rule execution with the ModSecurity debug log, but beware<br= > it is very verbose.<br> <br> Generally, it is best to set variables for display in the access log only<b= r> in phase 5, which is also executed for requests that have been denied<br> in an earlier phase.<br> <br> Best regards,<br> <br> Christian<br> <br> <br> <br> <br> On Wed, Jun 21, 2023 at 01:14:04PM +0530, homesh joshi wrote:<br> > Hi All,<br> > <br> > With regards to my approach for logging the modsec variables in apache= log<br> > has worked for me for almost a year now.<br> > However, today when I enabled "SecRuleEngine DetectionOnly" = for one of my<br> > websites. What I notice is that the apache logs are missing the right<= br> > variable data.<br> > e.g I tested SQL injection and i was not able to see the relevant<br> > information in apache log which I typically get when "SecRuleEngi= ne On"<br> > sample log for "SecRuleEngine DetectionOnly"<br> > 49.36.106.185 - - [21/Jun/2023:06:39:53 +0000] 200 23125 GET "-&q= uot;<br> > "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20= 100101<br> > Firefox/114.0" 3154 443 <a href=3D"http://example.com" rel=3D"nor= eferrer" target=3D"_blank">example.com</a> ZJKbOUfg7dWT82qCkvNySAAAAEU TLSv= 1.3<br> > TLS_AES_128_GCM_SHA256 0 4 L; "/" 15.24.15.205 39735 "&= quot; "" "" "/" 333762<br> > "/?k=3D1%20or%201=3D1"<br> > <br> > here rule id log is 333762 which is not the signature for SQL injectio= n<br> > <br> > So my conclusion is, in "SecRuleEngine On" rule evaluation s= tops when the<br> > first rule matches with the final action drop/block. Hence I am able t= o get<br> > the right rule ID and other variable data. But when "SecRuleEngin= e<br> > DetectionOnly" rule evaluation continues till the last rule and d= ue to<br> > which my variable data gets changed as per the rules getting evaluated= . Can<br> > I change this behaviour of modsecurity in Detectonly mode ? that it sh= ould<br> > stop the evaluation when it matches the first rule with final action o= f<br> > drop/block ( and not block/drop the transaction) ?<br> > <br> > Please suggest.<br> > <br> > Thanks,<br> > Homesh<br> > <br> > <br> > On Fri, Mar 25, 2022 at 4:08=E2=80=AFPM Christian Folini <<br> > <a href=3D"mailto:[email protected]" target=3D"_blank">chris= [email protected]</a>> wrote:<br> > <br> > > Thanks for the updates. I do not immediately see why it's not= working<br> > > completely. But glad you have a working solution.<br> > ><br> > > Best,<br> > ><br> > > Christian<br> > ><br> > > On Fri, Mar 25, 2022 at 01:59:38PM +0530, homesh joshi wrote:<br> > > > Dear Christian,<br> > > ><br> > > > I added setvar:tx.rule=3D1 in each rule and then added the f= ollowing rule,<br> > > > post which I am able to get 1 written in access logs ( via t= he %{waf} )<br> > > for<br> > > > the transactions which got blocked by Modsec. for other tran= sactions it<br> > > is<br> > > > missing and hence getting - in the logs. I was not able to d= irectly set<br> > > the<br> > > > WAF=3D1 in the rules via setenv:waf=3D1<br> > > ><br> > > > SecRule TX:rule "@eq 1" "phase:5,pass,setenv:= waf=3D1,id:'9001'"<br> > > ><br> > > > Will test this any update incase I face any challenge.<br> > > ><br> > > > Thanks,<br> > > > Homesh<br> > > ><br> > > ><br> > > > On Thu, Mar 24, 2022 at 6:35 PM Christian Folini <<br> > > > <a href=3D"mailto:[email protected]" target=3D"_bl= ank">[email protected]</a>> wrote:<br> > > ><br> > > > > I suggest you add this to every rule that detects / blo= cks something.<br> > > > > Thus not a SecAction, but attach the setenv to your exi= sting SecRules<br> > > > > where you want to see the flag.<br> > > > ><br> > > > > Alternatively, you can do a SecRule in phase 5 where yo= u test the<br> > > > > HTTP status and if it's 403, then you set the env.<= br> > > > ><br> > > > > Good luck!<br> > > > ><br> > > > > Christian<br> > > > ><br> > > > > On Thu, Mar 24, 2022 at 05:02:20PM +0530, homesh joshi = wrote:<br> > > > > > Dear Christian,<br> > > > > ><br> > > > > > Thanks. I think this will work for me. However, ca= n you please<br> > > explain<br> > > > > it a<br> > > > > > bit more on how this works.<br> > > > > > from your tutorial if i set up following rule<br> > > > > ><br> > > > > > # =3D=3D=3D ModSec performance calculations and va= riable export (ids:<br> > > 90100 -<br> > > > > 90199)<br> > > > > ><br> > > > > > SecAction "id:90100,phase:5,pass,nolog,setenv= :modsec=3D1"<br> > > > > ><br> > > > > > then for every access I see "1" in the a= ccess log.<br> > > > > ><br> > > > > > I think I will need to understand it more in order= to use it.<br> > > > > ><br> > > > > > Kindly explain<br> > > > > > 1) the configuration required for setenv by modify= ing each rule<br> > > > > ><br> > > > > > 2) the configuration required for more complicated= scheme which you<br> > > > > > are referring to<br> > > > > ><br> > > > > > Thanks,<br> > > > > ><br> > > > > > Homesh<br> > > > > ><br> > > > > ><br> > > > > > On Thu, Mar 24, 2022 at 11:52 AM Christian Folini = <<br> > > > > > <a href=3D"mailto:[email protected]" tar= get=3D"_blank">[email protected]</a>> wrote:<br> > > > > ><br> > > > > > > Hi there,<br> > > > > > ><br> > > > > > > On Thu, Mar 24, 2022 at 08:37:51AM +0530, hom= esh joshi wrote:<br> > > > > > > > Thanks for the clarification.<br> > > > > > > > I have already gone through excellent <a= href=3D"http://netnea.com" rel=3D"noreferrer" target=3D"_blank">netnea.com= </a> tutorials. I<br> > > have<br> > > > > > > already<br> > > > > > > > used some of the configuration from tuto= rial.I do not use crs.<br> > > > > > ><br> > > > > > > Thank you very much.<br> > > > > > ><br> > > > > > > > My objective here is that I want to get = a flag in access log<br> > > line if<br> > > > > > > modsec<br> > > > > > > > has taken any action on the transaction = say simply it can be a<br> > > field<br> > > > > like<br> > > > > > > > modsec=3D1 or modsec=3D0. This wi help m= e in separating transactions<br> > > > > which<br> > > > > > > are<br> > > > > > > > allowed.(modsec=3D0) So then it is easy = to show these transactions<br> > > in<br> > > > > the<br> > > > > > > > reporting system.<br> > > > > > ><br> > > > > > > I'd do a setenv then in the rules.<br> > > > > > ><br> > > > > > > ... "setenv:modsec=3D1"<br> > > > > > ><br> > > > > > > Similar to the way I set th various env varia= bles in phase 5. You<br> > > can<br> > > > > > > simply<br> > > > > > > add this to every rule you have. Or you set u= p a more complicated<br> > > > > scheme<br> > > > > > > and do it in the end in phase 5.<br> > > > > > ><br> > > > > > > Best,<br> > > > > > ><br> > > > > > > Christian<br> > > > > > ><br> > > > > > > ><br> > > > > > > > Kindly suggest.<br> > > > > > > ><br> > > > > > > > Thanks,<br> > > > > > > > Homesh<br> > > > > > > ><br> > > > > > > > On Thu, 24 Mar, 2022, 12:04 am Christian= Folini, <<br> > > > > > > > <a href=3D"mailto:christian.folini@netne= a.com" target=3D"_blank">[email protected]</a>> wrote:<br> > > > > > > ><br> > > > > > > > > HelloHomesh,<br> > > > > > > > ><br> > > > > > > > > Unfortunately, this is not how this= works.<br> > > > > > > > ><br> > > > > > > > > A ModSecuriy variable is not automa= tically an environment<br> > > variable.<br> > > > > > > > > And on top, the ModSec variable &qu= ot;rule" is only available<br> > > during the<br> > > > > > > > > execution of the very rule (and the= re might be many, many<br> > > rules).<br> > > > > > > > ><br> > > > > > > > > I suggest you read up on my free tu= torials published at<br> > > <a href=3D"http://netnea.com" rel=3D"noreferrer" target=3D"_blank= ">netnea.com</a><br> > > > > .<br> > > > > > > > > The one on logging and the ones on = the Core Rule Set are<br> > > proposing<br> > > > > > > > > ways to achieve something along the= se lines.<br> > > > > > > > ><br> > > > > > > > > Best,<br> > > > > > > > ><br> > > > > > > > > Christian<br> > > > > > > > ><br> > > > > > > > ><br> > > > > > > > > On Wed, Mar 23, 2022 at 11:12:58PM = +0530, homesh joshi wrote:<br> > > > > > > > > > Hi All,<br> > > > > > > > > ><br> > > > > > > > > > Hope you all are well.<br> > > > > > > > > ><br> > > > > > > > > > I want to add the modsecurity = variable e.g "<a href=3D"http://rule.id" rel=3D"noreferrer" target=3D"= _blank">rule.id</a>"in the<br> > > > > apache<br> > > > > > > access<br> > > > > > > > > > log via the extended format.<b= r> > > > > > > > > > I set the following line in /e= tc/apache2/apache.conf<br> > > > > > > > > ><br> > > > > > > > > > LogFormat "%h %l %u %t \&= quot;%r\" %>s %O \"%{Referer}i\"<br> > > > > > > \"%{User-Agent}i\"<br> > > > > > > > > > %{ms}T %p %{Host}i %{UNIQUE_ID= }e %{<a href=3D"http://rule.id" rel=3D"noreferrer" target=3D"_blank">rule.i= d</a>}e" extended<br> > > > > > > > > ><br> > > > > > > > > > However I am not getting the <= a href=3D"http://rule.id" rel=3D"noreferrer" target=3D"_blank">rule.id</a> = value in the access log<br> > > > > line.<br> > > > > > > > > ><br> > > > > > > > > > Kindly suggest.<br> > > > > > > > > ><br> > > > > > > > > > Thanks,<br> > > > > > > > > > Homesh<br> > > > > > > > ><br> > > > > > > > ><br> > > > > > > > > > ______________________________= _________________<br> > > > > > > > > > mod-security-users mailing lis= t<br> > > > > > > > > > <a href=3D"mailto:mod-security= [email protected]" target=3D"_blank">[email protected]= urceforge.net</a><br> > > > > > > > > ><br> > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-secur= ity-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.n= et/lists/listinfo/mod-security-users</a><br> > > > > > > > > > Commercial ModSecurity Rules a= nd Support from Trustwave's<br> > > > > SpiderLabs:<br> > > > > > > > > > <a href=3D"http://www.modsecur= ity.org/projects/commercial/rules/" rel=3D"noreferrer" target=3D"_blank">ht= tp://www.modsecurity.org/projects/commercial/rules/</a><br> > > > > > > > > > <a href=3D"http://www.modsecur= ity.org/projects/commercial/support/" rel=3D"noreferrer" target=3D"_blank">= http://www.modsecurity.org/projects/commercial/support/</a><br> > > > > > > > ><br> > > > > > > > ><br> > > > > > > > ><br> > > > > > > > > ___________________________________= ____________<br> > > > > > > > > mod-security-users mailing list<br> > > > > > > > > <a href=3D"mailto:mod-security-user= [email protected]" target=3D"_blank">[email protected]= orge.net</a><br> > > > > > > > ><br> > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-secur= ity-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.n= et/lists/listinfo/mod-security-users</a><br> > > > > > > > > Commercial ModSecurity Rules and Su= pport from Trustwave's<br> > > > > SpiderLabs:<br> > > > > > > > > <a href=3D"http://www.modsecurity.o= rg/projects/commercial/rules/" rel=3D"noreferrer" target=3D"_blank">http://= www.modsecurity.org/projects/commercial/rules/</a><br> > > > > > > > > <a href=3D"http://www.modsecurity.o= rg/projects/commercial/support/" rel=3D"noreferrer" target=3D"_blank">http:= //www.modsecurity.org/projects/commercial/support/</a><br> > > > > > > > ><br> > > > > > ><br> > > > > > ><br> > > > > > > > ________________________________________= _______<br> > > > > > > > mod-security-users mailing list<br> > > > > > > > <a href=3D"mailto:mod-security-users@lis= ts.sourceforge.net" target=3D"_blank">[email protected].= net</a><br> > > > > > > > <a href=3D"https://lists.sourceforge.net= /lists/listinfo/mod-security-users" rel=3D"noreferrer" target=3D"_blank">ht= tps://lists.sourceforge.net/lists/listinfo/mod-security-users</a><br> > > > > > > > Commercial ModSecurity Rules and Support= from Trustwave's<br> > > SpiderLabs:<br> > > > > > > > <a href=3D"http://www.modsecurity.org/pr= ojects/commercial/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.m= odsecurity.org/projects/commercial/rules/</a><br> > > > > > > > <a href=3D"http://www.modsecurity.org/pr= ojects/commercial/support/" rel=3D"noreferrer" target=3D"_blank">http://www= .modsecurity.org/projects/commercial/support/</a><br> > > > > > ><br> > > > > > ><br> > > > > > ><br> > > > > > > _____________________________________________= __<br> > > > > > > mod-security-users mailing list<br> > > > > > > <a href=3D"mailto:[email protected]= urceforge.net" target=3D"_blank">[email protected]</= a><br> > > > > > > <a href=3D"https://lists.sourceforge.net/list= s/listinfo/mod-security-users" rel=3D"noreferrer" target=3D"_blank">https:/= /lists.sourceforge.net/lists/listinfo/mod-security-users</a><br> > > > > > > Commercial ModSecurity Rules and Support from= Trustwave's<br> > > SpiderLabs:<br> > > > > > > <a href=3D"http://www.modsecurity.org/project= s/commercial/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.modsec= urity.org/projects/commercial/rules/</a><br> > > > > > > <a href=3D"http://www.modsecurity.org/project= s/commercial/support/" rel=3D"noreferrer" target=3D"_blank">http://www.mods= ecurity.org/projects/commercial/support/</a><br> > > > > > ><br> > > > ><br> > > > ><br> > > > > > _______________________________________________<br= > > > > > > mod-security-users mailing list<br> > > > > > <a href=3D"mailto:[email protected]= orge.net" target=3D"_blank">[email protected]</a><br= > > > > > > <a href=3D"https://lists.sourceforge.net/lists/lis= tinfo/mod-security-users" rel=3D"noreferrer" target=3D"_blank">https://list= s.sourceforge.net/lists/listinfo/mod-security-users</a><br> > > > > > Commercial ModSecurity Rules and Support from Trus= twave's SpiderLabs:<br> > > > > > <a href=3D"http://www.modsecurity.org/projects/com= mercial/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity= .org/projects/commercial/rules/</a><br> > > > > > <a href=3D"http://www.modsecurity.org/projects/com= mercial/support/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecuri= ty.org/projects/commercial/support/</a><br> > > > ><br> > > > ><br> > > > ><br> > > > > _______________________________________________<br> > > > > mod-security-users mailing list<br> > > > > <a href=3D"mailto:[email protected].= net" target=3D"_blank">[email protected]</a><br> > > > > <a href=3D"https://lists.sourceforge.net/lists/listinfo= /mod-security-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sou= rceforge.net/lists/listinfo/mod-security-users</a><br> > > > > Commercial ModSecurity Rules and Support from Trustwave= 's SpiderLabs:<br> > > > > <a href=3D"http://www.modsecurity.org/projects/commerci= al/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/= projects/commercial/rules/</a><br> > > > > <a href=3D"http://www.modsecurity.org/projects/commerci= al/support/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.or= g/projects/commercial/support/</a><br> > > > ><br> > ><br> > ><br> > > > _______________________________________________<br> > > > mod-security-users mailing list<br> > > > <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> > > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-= security-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourcefo= rge.net/lists/listinfo/mod-security-users</a><br> > > > Commercial ModSecurity Rules and Support from Trustwave'= s SpiderLabs:<br> > > > <a href=3D"http://www.modsecurity.org/projects/commercial/ru= les/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/proje= cts/commercial/rules/</a><br> > > > <a href=3D"http://www.modsecurity.org/projects/commercial/su= pport/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/pro= jects/commercial/support/</a><br> > ><br> > ><br> > ><br> > > _______________________________________________<br> > > mod-security-users mailing list<br> > > <a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a><br> > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-secur= ity-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.n= et/lists/listinfo/mod-security-users</a><br> > > Commercial ModSecurity Rules and Support from Trustwave's Spi= derLabs:<br> > > <a href=3D"http://www.modsecurity.org/projects/commercial/rules/"= rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/c= ommercial/rules/</a><br> > > <a href=3D"http://www.modsecurity.org/projects/commercial/support= /" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects= /commercial/support/</a><br> > ><br> <br> <br> > _______________________________________________<br> > mod-security-users mailing list<br> > <a href=3D"mailto:[email protected]" target=3D"= _blank">[email protected]</a><br> > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-u= sers" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/li= sts/listinfo/mod-security-users</a><br> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLa= bs:<br> > <a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel= =3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/comme= rcial/rules/</a><br> > <a href=3D"http://www.modsecurity.org/projects/commercial/support/" re= l=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/comm= ercial/support/</a><br> <br> <br> <br> _______________________________________________<br> mod-security-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"= rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l= istinfo/mod-security-users</a><br> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:<b= r> <a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no= referrer" target=3D"_blank">http://www.modsecurity.org/projects/commercial/= rules/</a><br> <a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"= noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/commercia= l/support/</a><br> </blockquote></div> --000000000000b6264705fea2ba7c-- --===============8658854852609852356== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============8658854852609852356== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ --===============8658854852609852356==--