ModSecurity v2.9.12 “Skipping request since there is nowhere to write to” despite valid SecAuditLog configuration

Hi,

On Amazon Linux 2023 (AArch64) using ModSecurity v2.9.12 with Apache 2.4.65, audit logs fail to write even with valid configuration and writable path.
Debug logs report:

[15/Oct/2025:13:55:40.259888 +0200] [10.104.19.109/sid#aaaae39e0938][rid#ffff18026b80][/health/status][4] Audit log: Logging this transaction. [15/Oct/2025:13:55:40.259892 +0200] [10.104.19.109/sid#aaaae39e0938][rid#ffff18026b80][/health/status][4] Audit log: Skipping request since there is nowhere to write to.

Environment:

OS: Amazon Linux 2023 (latest patched)

Architecture: aarch64

Apache version: httpd 2.4.65-1.amzn2023.0.1

ModSecurity version: 2.9.12-1.amzn2023.0.1

SELinux: disabled

Config (minimal reproduction):

<IfModule security2_module>
  SecRuleEngine On
  SecRequestBodyAccess On
  SecResponseBodyAccess Off
  SecDebugLog /var/log/httpd/modsec_debug_test.log
  SecDebugLogLevel 5
  SecAuditEngine On
  SecAuditLogRelevantStatus ".*"
  SecAuditLogType Serial
  SecAuditLog /var/log/httpd/modsec_audit_test.log
  SecRule ARGS:testparam "@streq attack" "id:1,phase:2,deny,log,auditlog,msg:action_detected,ctl:debugLogLevel=9"
</IfModule>

Apache reports Syntax OK

Steps to Reproduce:

Install httpd + mod_security on Amazon Linux 2023.

Apply minimal config above.

Restart httpd and send any request.

Observe debug log.

Expected Result:
Audit log file (SecAuditLog) should receive entries.

Actual Result:
Log is skipped with nowhere to write to even though the file exists and is writable.

Additional Notes:

No SELinux denials or permission errors.

Start by reproducing the report with the minimal configuration, especially SecAuditLog /var/log/httpd/modsec_audit_test.log and SecDebugLog /var/log/httpd/modsec_debug_test.log, then inspect the audit-log handling entry point that emits “nowhere to write to.” Done means requests produce entries in the configured audit log without permission or SELinux errors.