SanitiseArg does not work in RequestBody

SanitiseArg does not work in RequestBody
This time without messed up markdown :)

Taken right from the docs: https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#user-content-sanitiseArg

I want to sanitiese two password fields in a POST body, but the Rule is not working. I am on Ubuntu 22.04.03 LTS for testing and Apache 2.4.52

I have defined five rules (for each phase for testing, although only phase 2 should be relevant) in my custom rules:. see the waf_adaption attachment:
SecAction "auditlog,phase:2,id:131,sanitiseArg:password1,sanitiseArg:password2"
Logs and dumps

Output of:

1. DebugLogs (level 9)
2. AuditLogs
3. Error logs: is empty
4. If there is a crash, the core dump file: n crash

See the attached files, also the modsecurity configuration

To Reproduce

Steps to reproduce the behavior:

curl 'http://localhost/test' -X POST -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br' -H 'Connection: keep-alive' -H 'Upgrade-Insecure-Requests: 1' -H 'Sec-Fetch-Dest: document' -H 'Sec-Fetch-Mode: navigate' -H 'Sec-Fetch-Site: same-origin' -H 'Sec-Fetch-User: ?1' -H 'Origin: http://localhost' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' --data-raw $'password1=xyz&password2=test&inj=1\' or 1=1;--'

Expected behavior

I would expect that password1 and password2 are sanitised in the audit log, when appearing in the request body.

Server (please complete the following information):

• ModSecurity version (and connector): libapache2-mod-security2 2.9.5-1
• WebServer: Apache 2.4.52
• OS (and distro):Ubuntu 22.04.3 LTS

Rule Set (please complete the following information):

• Running any public or commercial rule set? OWASP CRS 3.3.0
• What is the version number? 3.3.0

I added the configuration and log files as an attachmen

Add any other context about the problem here.
modsec_debug.log
modsec_audit.log
modsecurity.txt
security2.txt
waf_adaption.txt

Reproduce the report with the provided curl command and inspect waf_adaption.txt, modsecurity.txt, and the attached debug and audit logs. Compare the observed RequestBody behavior with the SanitiseArg documentation and determine why password1 and password2 are not masked. Done means the relevant request-body fields are sanitised in the audit log without breaking the reported rule setup.