owasp-modsecurity / owasp-modsecurity/ModSecurity
Concurrent log index files do not respect SecAuditLogRelevantStatus
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
audit.log_0 and audit.log_1 do not contain 404s following SecAuditLogRelevantStatus being set to: SecAuditLogRelevantStatus "^(?:5|4)" in concurrent logging mode with JSON format.
Logs and dumps
All the status codes in the log index files are as described.
To Reproduce
Steps to reproduce the behavior:
Configure audit logging as described and cause 404s in test server.
Expected behavior
All concurrent log entries that match the relevant status should exist in the log index files.
Server (please complete the following information):
- ModSecurity v3.0.8 with nginx-connector v1.0.3
- nginx-1.22.0
- Linux, ubuntu-20.04
Rule Set (please complete the following information):
- OWASP rules 3.0.2
- Some simple rules that return 404
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing concurrent JSON audit logging with SecAuditLogRelevantStatus set to match 4xx and 5xx responses, then cause 404s in the test server. Compare audit.log_0 and audit.log_1 with the log index status codes; done means matching relevant-status entries appear in the concurrent log index files.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, nginx
- Domain
- observability, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100