owasp-modsecurity / owasp-modsecurity/ModSecurity

No error log if noauditlog is set

Open
#3,180 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

3.x bug
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

The rule like this example below does not log anything at all in error log, I have to activate auditlog instead noauditlog to get log in error log (and also in audit log, but this is not what I want):

SecRule REQUEST_URI "@beginsWith /" "id:1000100,phase:1,log,noauditlog,pass,severity:INFO,logdata:'Test'"

Expected behavior

For every request beginning with / the rule above should log in error log only, and no audit log, but I get no log at all.
I have to active audit log to make the log appear in both error log and audit log, but I so not want any audit log for this rule.

Server (please complete the following information):

  • ModSecurity version (and connector): ModSecurity v3.0.12 with nginx-connector v1.0.3
  • WebServer: nginx/1.24.0
  • OS (and distro): Linux, Debian 11.9

Rule Set (please complete the following information):

  • CRS 3.3.5

Additional context

My log config is configured like this :

     #SecDebugLog /var/log/nginx/error.log
      SecDebugLogLevel 0

      SecAuditEngine RelevantOnly
      SecAuditLogRelevantStatus "^(?:5|4(?!04))"
      SecAuditLogFormat JSON

      SecAuditLogType Serial
      SecAuditLog /var/log/nginx/error.log

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the behavior with the supplied SecRule and SecAuditEngine configuration on ModSecurity v3.0.12 with the nginx connector. Start by tracing how log, noauditlog, and audit-log relevance are handled, then verify that matching requests produce an error-log entry without an audit-log entry. Done means the reported rule logs logdata in the error log while remaining absent from the audit log.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.