owasp-modsecurity / owasp-modsecurity/ModSecurity

Unable to turn off writing to the server log even set to `nolog,noauditlog`

Open
#2,698 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

3.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug
I have set this to return status 418 but i do not want any logs inside the nginx

SecRule REQUEST_HEADERS"@contains vip_checking" "phase:2,id:70010,deny,nolog,noauditlog,status:418"

But it somehow show error log in nginx.

*441580 [client 10.42.0.1] ModSecurity: Access denied with code 418 (phase 2). Matched "Operator `Contains' with parameter `vip_checking' against variable

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file, test, or entry point is named. Start by reproducing the shown SecRule with the nginx connector and compare the effects of nolog and noauditlog on the nginx error log. Done when the rule still returns status 418 without producing the reported log entry.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, nginx
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.