SecAuditLogFormat set to JSON prints logs in native format aswell

Describe the bug

Unable to get json logs for Modsecurity in K8s ingress-nginx even after setting SecAuditLogFormat: JSON.

I am setting SecAuditLogFormat: JSON and I want that the logs should be printed in json format only in ingress controller pod. Is it possible to remove/disable the logs in non json format from modsecurity if SecAuditLogFormat: JSON.

Logs and dumps

Current behaviour - If you see in below logs, line number 1 & 2 are not in json format and we do not need these type of logs if SecAuditLogFormat: JSON .

(1) 2024/03/01 20:24:46 [error] 159#159: *2640 [client 111.111.11.11] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Rx' with parameter `.*[Cc]lass\..*' against variable `FULL_REQUEST' (Value: `host: example.com\x0auser-agent: curl/7.81.0\x0aaccept: */*\x0ax-test: Class.devi (22 characters omitted)' ) [file "/etc/nginx/owasp-modsecurity-crs/custom-modsec-config/custom-rules.conf"] [line "1"] [id "1"] [rev ""] [msg "spring4shell Class detected"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "11.1.1.111"] [uri "/"] [unique_id "170932468636.278391"] [ref "o0,104v118,104"], client: 111.111.11.11, server: example.com, request: "HEAD / HTTP/2.0", host: "example.com"

(2) 2024/03/01 20:24:46 [error] 159#159: *2640 [client 111.111.11.11] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Rx' with parameter `.*[Cc]lass\..*' against variable `FULL_REQUEST' (Value: `host: example.com\x0auser-agent: curl/7.81.0\x0aaccept: */*\x0ax-test: Class.devi (22 characters omitted)' ) [file "/etc/nginx/owasp-modsecurity-crs/custom-modsec-config/custom-rules.conf"] [line "1"] [id "1"] [rev ""] [msg "spring4shell Class detected"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "11.1.1.111"] [uri "/"] [unique_id "170932468683.123247"] [ref "o0,104v118,104"], client: 111.111.11.11, server: example.com, request: "HEAD / HTTP/2.0", host: "example.com"

(3) { "time_local": "01/Mar/2024:20:24:46 +0000", "remote_addr": "111.111.11.11", "remote_user": "","request": "HEAD / HTTP/2.0", "status": "403", "body_bytes_sent": "0", "request_time": "0.003", "http_referrer": "", "http_user_agent": "curl/7.81.0", "http_x_forwarded_for": "111.111.11.11", "http_session": "", "upstream_response_time": "0.003", "method": "HEAD", "request_uri": "/", "host": "example.com", "x-b3-traceid": "01aekjkjh122118f60" }

(4) {"transaction":{"client_ip":"111.111.11.11","time_stamp":"Fri Mar  1 20:24:46 2024","server_id":"a0490583sasasa879asas98asee8c49fe184b3","client_port":15943,"host_ip":"11.1.1.111","host_port":443,"unique_id":"170932468683.123247","request":{"method":"HEAD","http_version":2.0,"uri":"/","body":"","headers":{"host":"example.com","user-agent":"curl/7.81.0","accept":"*/*","x-test":"Class.devil.java.com"}},"response":{"http_code":403,"headers":{"Server":"","Server":"","Date":"Fri, 01 Mar 2024 20:24:46 GMT","Content-Type":"text/html","X-Request-Id":"","Connection":"close","X-XSS-Protection":"0","Vary":"Accept-Encoding","Content-Security-Policy":"frame-src 'self'; frame-ancestors 'self'; object-src 'self';","Referrer-Policy":"strict-origin-when-cross-origin"}},"producer":{"modsecurity":"ModSecurity v3.0.8 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.5\""]},"messages":[{"message":"spring4shell Class detected","details":{"match":"Matched \"Operator `Rx' with parameter `.*[Cc]lass\\..*' against variable `FULL_REQUEST' (Value: `host: example.com\\x0auser-agent: curl/7.81.0\\x0aaccept: */*\\x0ax-test: Class.devi (22 characters omitted)' )","reference":"o0,104v118,104","ruleId":"1","file":"/etc/nginx/owasp-modsecurity-crs/custom-modsec-config/custom-rules.conf","lineNumber":"1","data":"","severity":"0","ver":"","rev":"","tags":[],"maturity":"0","accuracy":"0"}}]}}

To Reproduce

Enable modsecurity with ingress-nginx in k8s cluster . Use below configmap and the server configuration as defined in below server section

Modsecurity ConfigMap:

apiVersion: v1
data:
  custom-rules.conf: |-
    SecRule FULL_REQUEST "@rx .*[Cc]lass\..*" "id:1,phase:2,deny,status:403,msg:spring4shell Class detected,ctl:ruleEngine=On
    SecRule FULL_REQUEST "@rx .*tomcatwar\.jsp.*" "id:2,phase:2,deny,status:403,msg:spring4shell tomcatwar detected,ctl:ruleEngine=On
    SecRule REMOTE_ADDR "@ipMatch 127.0.0.1" "id:3,phase:1,pass,nolog,ctl:ruleEngine=Off
    SecRule FULL_REQUEST "@rx .*java\.io\.InputStream.*" "id:4,phase:2,deny,status:403,msg:spring4shell InputStream detected,ctl:ruleEngine=On
  nginx-modsecurity.conf: |-
    SecRuleEngine DetectionOnly
    SecAuditLog /dev/stdout
    SecAuditEngine RelevantOnly
    SecAuditLogFormat JSON
    SecAuditLogRelevantStatus "^(?:4(?!04))
    SecAction "id:900260,phase:1,nolog,pass,t:none,setvar:'tx.static_extensions=/.jpg/ /.jpeg/ /.png/ /.gif/ /.js/ /.css/ /.ico/ /.svg/ /.webp/'
    SecAction "id:900700,phase:1,nolog,pass,t:none,setvar:'tx.dos_burst_time_slice=60',setvar:'tx.dos_counter_threshold=10000',setvar:'tx.dos_block_timeout=600'
    Include /etc/nginx/owasp-modsecurity-crs/crs-setup.conf
    Include /etc/nginx/owasp-modsecurity-crs/custom-modsec-config/custom-rules.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
    Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf
kind: ConfigMap
metadata:
  name: modsecurity-config
  namespace: demo

A curl command line that mimics the original request and reproduces the problem. Or a ModSecurity v3 test case.

curl -I -H "X-test: Class.devil.java.com" "https://example.com"

Expected behavior

Want only json logs to be printed as line number 2 in below logs and should not print line number 1 & 2 as in above logs, when SecAuditLogFormat: JSON.

(1) { "time_local": "01/Mar/2024:20:24:46 +0000", "remote_addr": "111.111.11.11", "remote_user": "","request": "HEAD / HTTP/2.0", "status": "403", "body_bytes_sent": "0", "request_time": "0.003", "http_referrer": "", "http_user_agent": "curl/7.81.0", "http_x_forwarded_for": "111.111.11.11", "http_session": "", "upstream_response_time": "0.003", "method": "HEAD", "request_uri": "/", "host": "example.com", "x-b3-traceid": "01aekjkjh122118f60" }

(2) {"transaction":{"client_ip":"111.111.11.11","time_stamp":"Fri Mar  1 20:24:46 2024","server_id":"a0490583sasasa879asas98asee8c49fe184b3","client_port":15943,"host_ip":"11.1.1.111","host_port":443,"unique_id":"170932468683.123247","request":{"method":"HEAD","http_version":2.0,"uri":"/","body":"","headers":{"host":"example.com","user-agent":"curl/7.81.0","accept":"*/*","x-test":"Class.devil.java.com"}},"response":{"http_code":403,"headers":{"Server":"","Server":"","Date":"Fri, 01 Mar 2024 20:24:46 GMT","Content-Type":"text/html","X-Request-Id":"","Connection":"close","X-XSS-Protection":"0","Vary":"Accept-Encoding","Content-Security-Policy":"frame-src 'self'; frame-ancestors 'self'; object-src 'self';","Referrer-Policy":"strict-origin-when-cross-origin"}},"producer":{"modsecurity":"ModSecurity v3.0.8 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.5\""]},"messages":[{"message":"spring4shell Class detected","details":{"match":"Matched \"Operator `Rx' with parameter `.*[Cc]lass\\..*' against variable `FULL_REQUEST' (Value: `host: example.com\\x0auser-agent: curl/7.81.0\\x0aaccept: */*\\x0ax-test: Class.devi (22 characters omitted)' )","reference":"o0,104v118,104","ruleId":"1","file":"/etc/nginx/owasp-modsecurity-crs/custom-modsec-config/custom-rules.conf","lineNumber":"1","data":"","severity":"0","ver":"","rev":"","tags":[],"maturity":"0","accuracy":"0"}}]}}

Server (please complete the following information):

• ModSecurity version (and connector): ModSecurity v3.0.8 with nginx-connector v1.0.3
• WebServer: ingress-nginx-v1.9.5
• OS (and distro): Linux

Rule Set (please complete the following information):

• Running any public or commercial rule set? SpiderLabs commercial rules
• What is the version number? OWASP_CRS/3.3.5

Additional context

Add any other context about the problem here.

Start with the SecAuditLog, SecAuditLogFormat, and SecAuditEngine directives in the reported ModSecurity v3.0.8 and nginx-connector v1.0.3 setup, then reproduce the behavior with the provided curl command and configuration. Determine whether the non-JSON lines come from ModSecurity or ingress-nginx logging; done means the configured output contains only the requested JSON audit records without the extra native-format entries.