owasp-modsecurity / owasp-modsecurity/ModSecurity

rotatelogs.exe Not Working in IIS 10 with v2.9.3

Open
#2,075 5 comments 0 reactions 1 assignee View on GitHub

@victorhora is already working on this.

Since Apr 23, 2019.

2.x Platform - IIS workaround available
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

I tried configuring and using rotatelogs.exe with v2.9.3 on IIS 10. According to this issue - https://github.com/SpiderLabs/ModSecurity/issues/685, it should have worked

I'm using rotatelogs.exe from here: https://www.apachehaus.com/cgi-bin/download.plx and the relavent part in my config file is shown below

Logs and dumps

ModSecurity throws the following error in the Event Log where line 199 points to the SecAuditLog line shown below:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='ModSecurity'/>
        <EventID Qualifiers='0'>1</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime='2019-04-20T07:22:07.968155800Z'/>
        <EventRecordID>11784</EventRecordID>
        <Channel>Application</Channel>
        <Computer>WIN10CLIENT1.example.com</Computer>
        <Security/>
    </System>
    <EventData>
        <Data>Syntax error in config file C:\Program Files\ModSecurity IIS\modsecurity.conf, line 199: ModSecurity: Failed to open the audit log pipe: c:\rotatelogs.exe c:\inetpub\logs\modsec_audit.log 120</Data>
    </EventData>
</Event>

To Reproduce

The relevant part from my config is as follows:

SecAuditLogFormat JSON

# Log everything we know about a transaction.
SecAuditLogParts ABIJDEFHZ

# Use a single file for logging. This is much easier to look at, but
# assumes that you will use the audit log only ocassionally.
#
SecAuditLogType Serial
SecAuditLog "|c:\rotatelogs.exe c:\inetpub\logs\modsec_audit.log 120"

Expected behavior

It should rotate the audit log

Server (please complete the following information):

  • ModSecurity version (and connector): [ModSecurity v2.9.3]
  • WebServer: [IIS 10]
  • OS (and distro): [Windows 10]

Rule Set (please complete the following information):
CRS (v3.0.2)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.