owasp-modsecurity / owasp-modsecurity/ModSecurity
No error log if noauditlog is set
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
The rule like this example below does not log anything at all in error log, I have to activate auditlog instead noauditlog to get log in error log (and also in audit log, but this is not what I want):
SecRule REQUEST_URI "@beginsWith /" "id:1000100,phase:1,log,noauditlog,pass,severity:INFO,logdata:'Test'"
Expected behavior
For every request beginning with / the rule above should log in error log only, and no audit log, but I get no log at all.
I have to active audit log to make the log appear in both error log and audit log, but I so not want any audit log for this rule.
Server (please complete the following information):
- ModSecurity version (and connector): ModSecurity v3.0.12 with nginx-connector v1.0.3
- WebServer: nginx/1.24.0
- OS (and distro): Linux, Debian 11.9
Rule Set (please complete the following information):
- CRS 3.3.5
Additional context
My log config is configured like this :
#SecDebugLog /var/log/nginx/error.log
SecDebugLogLevel 0
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogFormat JSON
SecAuditLogType Serial
SecAuditLog /var/log/nginx/error.log
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the behavior with the supplied SecRule and SecAuditEngine configuration on ModSecurity v3.0.12 with the nginx connector. Start by tracing how log, noauditlog, and audit-log relevance are handled, then verify that matching requests produce an error-log entry without an audit-log entry. Done means the reported rule logs logdata in the error log while remaining absent from the audit log.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100