Logging to NGINX error_log but not audit

Describe the bug

I'm testing a WAF setup with nginx, modsecurity and the OWASP ruleset. I am just running a simple XSS curl attack.

The attack is being blocked and a 403 is being returned. However, the attack isn't logged in the audit log, only the nginx error log. We need to send the logs to a SIEM and we need any blocks to be in the audit log.

Logs and dumps

Output of:

1. DebugLogs (level 9)
2. AuditLogs
3. Error logs
4. If there is a crash, the core dump file.

Notice: Be carefully to not leak any confidential information.

[157893220069.056272] [] [4] Initializing transaction [157893220069.056272] [] [4] Transaction context created. [157893220069.056272] [] [4] Starting phase CONNECTION. (SecRules 0) [157893220069.056272] [] [9] This phase consists of 28 rule(s). [157893220069.056272] [] [4] Starting phase URI. (SecRules 0 + 1/2) [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Adding request argument (GET): name "q", value ""><script>alert(1)</script>" [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Starting phase REQUEST_HEADERS. (SecRules 1) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] This phase consists of 135 rule(s). [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 200000) Executing operator "Rx" with param "(?:application(?:/soap\+|/)|text/)xml" against REQUEST_HEADERS:Content-Type. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 200001) Executing operator "Rx" with param "application/json" against REQUEST_HEADERS:Content-Type. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 900990) Executing unconditional rule... [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:crs_setup_version with value: 330 [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901001) Executing operator "Eq" with param "0" against TX:crs_setup_version. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:crs_setup_version) [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901100) Executing operator "Eq" with param "0" against TX:inbound_anomaly_score_threshold. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:inbound_anomaly_score_threshold) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:inbound_anomaly_score_threshold with value: 5 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901110) Executing operator "Eq" with param "0" against TX:outbound_anomaly_score_threshold. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:outbound_anomaly_score_threshold) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:outbound_anomaly_score_threshold with value: 4 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901120) Executing operator "Eq" with param "0" against TX:paranoia_level. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:paranoia_level) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:paranoia_level with value: 1 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901125) Executing operator "Eq" with param "0" against TX:executing_paranoia_level. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:executing_paranoia_level) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:executing_paranoia_level with value: 1 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901130) Executing operator "Eq" with param "0" against TX:sampling_percentage. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:sampling_percentage) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:sampling_percentage with value: 100 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901140) Executing operator "Eq" with param "0" against TX:critical_anomaly_score. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:critical_anomaly_score) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:critical_anomaly_score with value: 5 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901141) Executing operator "Eq" with param "0" against TX:error_anomaly_score. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:error_anomaly_score) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:error_anomaly_score with value: 4 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901142) Executing operator "Eq" with param "0" against TX:warning_anomaly_score. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:warning_anomaly_score) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:warning_anomaly_score with value: 3 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901143) Executing operator "Eq" with param "0" against TX:notice_anomaly_score. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:notice_anomaly_score) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:notice_anomaly_score with value: 2 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901150) Executing operator "Eq" with param "0" against TX:do_reput_block. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:do_reput_block) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:do_reput_block with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901152) Executing operator "Eq" with param "0" against TX:reput_block_duration. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:reput_block_duration) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:reput_block_duration with value: 300 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901160) Executing operator "Eq" with param "0" against TX:allowed_methods. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:allowed_methods) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:allowed_methods with value: GET HEAD POST OPTIONS [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901162) Executing operator "Eq" with param "0" against TX:allowed_request_content_type. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:allowed_request_content_type) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:allowed_request_content_type with value: application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901168) Executing operator "Eq" with param "0" against TX:allowed_request_content_type_charset. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:allowed_request_content_type_charset) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:allowed_request_content_type_charset with value: utf-8|iso-8859-1|iso-8859-15|windows-1252 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901163) Executing operator "Eq" with param "0" against TX:allowed_http_versions. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:allowed_http_versions) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:allowed_http_versions with value: HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901164) Executing operator "Eq" with param "0" against TX:restricted_extensions. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:restricted_extensions) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:restricted_extensions with value: .asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/ [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901165) Executing operator "Eq" with param "0" against TX:restricted_headers. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:restricted_headers) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:restricted_headers with value: /proxy/ /lock-token/ /content-range/ /if/ [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901166) Executing operator "Eq" with param "0" against TX:static_extensions. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:static_extensions) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:static_extensions with value: /.jpg/ /.jpeg/ /.png/ /.gif/ /.js/ /.css/ /.ico/ /.svg/ /.webp/ [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901167) Executing operator "Eq" with param "0" against TX:enforce_bodyproc_urlencoded. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:enforce_bodyproc_urlencoded) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:enforce_bodyproc_urlencoded with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901200) Executing unconditional rule... [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:anomaly_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:anomaly_score_pl1 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:anomaly_score_pl2 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:anomaly_score_pl3 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:anomaly_score_pl4 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:sql_injection_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:xss_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:rfi_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:lfi_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:rce_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:php_injection_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:http_violation_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:session_fixation_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:inbound_anomaly_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:outbound_anomaly_score with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:outbound_anomaly_score_pl1 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:outbound_anomaly_score_pl2 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:outbound_anomaly_score_pl3 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:outbound_anomaly_score_pl4 with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:sql_error_match with value: 0 [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901318) Executing operator "Rx" with param "^.*$" against REQUEST_HEADERS:User-Agent. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:sha1: "V��ٶ��RՕ��_ׂ)+$�" [157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:hexEncode: "56c1a7d9b6b7cf5217d595b3825fd782292b24cc" [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "56c1a7d9b6b7cf5217d595b3825fd782292b24cc" (Variable: REQUEST_HEADERS:User-Agent) [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated. [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:ua_hash with value: 56c1a7d9b6b7cf5217d595b3825fd782292b24cc [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1. [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass. [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass [157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901321) Executing unconditional rule... [157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running [independent] (non-disruptive) action: setvar [157893220069.056272] [/?q="><script>alert(1)</script>] [8] Saving variable: TX:real_ip with value: 172.17.0.1 [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog [157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: initcol [157893220069.056272] [/?q="><script>alert(1)</script>] [5] Collection global' initialized with value: global
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: initcol
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Collection `ip' initialized with value: 172.17.0.1_56c1a7d9b6b7cf5217d595b3825fd782292b24cc
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901340) Executing operator "Rx" with param "(?:URLENCODED|MULTIPART|XML|JSON)" against REQBODY_PROCESSOR.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "" (Variable: REQBODY_PROCESSOR)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving msg: Enabling body inspection
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (non-disruptive) action: tag
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule tag: paranoia-level/1
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: noauditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: ctl
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901350) Executing operator "Eq" with param "1" against TX:enforce_bodyproc_urlencoded.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:urlDecodeUni: "0"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:enforce_bodyproc_urlencoded)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901400) Executing operator "Eq" with param "100" against TX:sampling_percentage.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "100" (Variable: TX:sampling_percentage)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '901410' due to a SecMarker: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '901420' due to a SecMarker: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '901430' due to a SecMarker: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '901440' due to a SecMarker: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '901450' due to a SecMarker: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-SAMPLING
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 6 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 901500) Executing operator "Lt" with param "1" Was: "" against TX:executing_paranoia_level.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:executing_paranoia_level)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 905100) Executing operator "StrEq" with param "GET /" against REQUEST_LINE.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "GET /?q="><script>alert(1)</script> HTTP/1.1" (Variable: REQUEST_LINE)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 905110) Executing operator "IpMatch" with param "127.0.0.1,::1" against REMOTE_ADDR.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "172.17.0.1" (Variable: REMOTE_ADDR)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 910011) Executing operator "Lt" with param "1" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 910013) Executing operator "Lt" with param "2" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-REQUEST-910-IP-REPUTATION
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '910015' due to a SecMarker: END-REQUEST-910-IP-REPUTATION
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '910017' due to a SecMarker: END-REQUEST-910-IP-REPUTATION
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-REQUEST-910-IP-REPUTATION
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-REQUEST-910-IP-REPUTATION
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 3 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 911011) Executing operator "Lt" with param "1" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 911013) Executing operator "Lt" with param "2" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-REQUEST-911-METHOD-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '911015' due to a SecMarker: END-REQUEST-911-METHOD-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '911017' due to a SecMarker: END-REQUEST-911-METHOD-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-REQUEST-911-METHOD-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-REQUEST-911-METHOD-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 3 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 912100) Executing operator "Eq" with param "0" against TX:dos_burst_time_slice.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:dos_burst_time_slice)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Executing chained rule.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 0) Executing operator "Eq" with param "0" against TX:dos_counter_threshold.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:dos_counter_threshold)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Executing chained rule.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 0) Executing operator "Eq" with param "0" against TX:dos_block_timeout.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "0" (Variable: TX:dos_block_timeout)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '912011' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '912120' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '912130' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '912013' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '912015' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '912017' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-REQUEST-912-DOS-PROTECTION
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-DOS-PROTECTION-CHECKS
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 8 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 913011) Executing operator "Lt" with param "1" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 913013) Executing operator "Lt" with param "2" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-REQUEST-913-SCANNER-DETECTION
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '913015' due to a SecMarker: END-REQUEST-913-SCANNER-DETECTION
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '913017' due to a SecMarker: END-REQUEST-913-SCANNER-DETECTION
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-REQUEST-913-SCANNER-DETECTION
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-REQUEST-913-SCANNER-DETECTION
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 3 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 920011) Executing operator "Lt" with param "1" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 920160) Executing operator "Rx" with param "^\d+$" against REQUEST_HEADERS:Content-Length.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 920470) Executing operator "Rx" with param "^[\w/.+-]+(?:\s?;\s?(?:boundary|charset)\s?=\s?['"\w.()+,/:=?-]+)?$" against REQUEST_HEADERS:Content-Type.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 920480) Executing operator "Rx" with param "charset\s*=\s*["']?([^;"'\s]+)" against REQUEST_HEADERS:Content-Type.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 920430) Executing operator "Within" with param "HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0" Was: "" against REQUEST_PROTOCOL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "HTTP/1.1" (Variable: REQUEST_PROTOCOL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 920013) Executing operator "Lt" with param "2" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-REQUEST-920-PROTOCOL-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '920015' due to a SecMarker: END-REQUEST-920-PROTOCOL-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '920490' due to a SecMarker: END-REQUEST-920-PROTOCOL-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '920017' due to a SecMarker: END-REQUEST-920-PROTOCOL-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-REQUEST-920-PROTOCOL-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-REQUEST-920-PROTOCOL-ENFORCEMENT
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 4 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 921011) Executing operator "Lt" with param "1" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 921160) Executing operator "Rx" with param "[\n\r]+(?:\s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))\s*:" against ARGS_GET_NAMES|ARGS_GET.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:urlDecodeUni: "q"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:htmlEntityDecode: "q"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:lowercase: "q"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "q" (Variable: ARGS_GET_NAMES:q)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:urlDecodeUni: ""><script>alert(1)</script>"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:htmlEntityDecode: ""><script>alert(1)</script>"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:lowercase: ""><script>alert(1)</script>"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: ""><script>alert(1)</script>" (Variable: ARGS_GET:q)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 921190) Executing operator "Rx" with param "[\n\r]" against REQUEST_FILENAME.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] T (0) t:urlDecodeUni: "/"
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "/" (Variable: REQUEST_FILENAME)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 921013) Executing operator "Lt" with param "2" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-REQUEST-921-PROTOCOL-ATTACK
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '921015' due to a SecMarker: END-REQUEST-921-PROTOCOL-ATTACK
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '921017' due to a SecMarker: END-REQUEST-921-PROTOCOL-ATTACK
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-REQUEST-921-PROTOCOL-ATTACK
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-REQUEST-921-PROTOCOL-ATTACK
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 3 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 930011) Executing operator "Lt" with param "1" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 930013) Executing operator "Lt" with param "2" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars updated.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 1.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: auditlog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Saving transaction to logs
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: status
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: nolog
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Running action: skipAfter
[157893220069.056272] [/?q="><script>alert(1)</script>] [5] Setting skipAfter for: END-REQUEST-930-APPLICATION-ATTACK-LFI
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Running (disruptive) action: pass.
[157893220069.056272] [/?q="><script>alert(1)</script>] [8] Running action pass
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '930015' due to a SecMarker: END-REQUEST-930-APPLICATION-ATTACK-LFI
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '930017' due to a SecMarker: END-REQUEST-930-APPLICATION-ATTACK-LFI
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule:
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Skipped rule id '0' due to a SecMarker: END-REQUEST-930-APPLICATION-ATTACK-LFI
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Rule: END-REQUEST-930-APPLICATION-ATTACK-LFI
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Out of a SecMarker after skip 3 rules.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 931011) Executing operator "Lt" with param "1" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] Rule returned 0.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Matched vars cleaned.
[157893220069.056272] [/?q="><script>alert(1)</script>] [4] (Rule: 931013) Executing operator "Lt" with param "2" against TX:EXECUTING_PARANOIA_LEVEL.
[157893220069.056272] [/?q="><script>alert(1)</script>] [9] Target value: "1" (Variable: TX:EXECUTING_PARANOIA_LEVEL)
[157893220069.0