FYI - this has been fixed already -
https://www.modsecurity.org/tracker/browse/MODSEC-204
It is in the SVN trunk version -
http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/mlogc/
mlogc-batch-load.pl.in?revision=1615
-Ryan
On 3/2/11 7:37 AM, "Klaubert Herr da Silveira" <klaubert@...> wrote:
>I just go around this by using the /mlogc-batch-load.pl provided with
>modsecurity, running each 5 min on crontab.
>
>I just need to make a simple patch against it beacuse their regexp
>don't get all events:
>
>--- /tmp/mlogc-batch-load.pl 2011-03-02 09:32:10.000000000 -0300
>+++ /usr/sbin/mlogc-batch-load.pl 2011-02-21 19:09:42.000000000
>-0300
>@@ -42,7 +42,7 @@
>
>
>(($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size) = stat($_)) &&
> -f _ &&
>- /^\d{8}-\d+-\w{24}$/s
>+ /^\d{8}-\d+-[\w-@...
> && (($fn = $File::Find::name) =~
>s/^\Q$ROOTDIR\E//)
> && push(@AUDIT, [$fn, $size]);
>
>the way to get it working is configure modsecurity to put events on
>directory "SecAuditLogStorageDir /var/log/mlogc/modsec_audit" and
>_don't_ pipe the log to mlogc, i.e. "SecAuditLog
>/var/log/mlogc/modsec_audit.log"
>
>Run from times to times...
>/usr/sbin/mlogc-batch-load.pl /var/log/mlogc/modsec_audit/
>/usr/sbin/mlogc /etc/mlogc.conf
>
>Best regards,
>
>Klaubert
>
>
>On Mon, Feb 28, 2011 at 6:41 PM, Josh Amishav-Zlatin <jamuse@...>
>wrote:
>> On Mon, Feb 28, 2011 at 8:39 PM, George Kobiashvili
>> <gkobiashvili@...> wrote:
>>
>>> This seems to be the known problem:
>>> http://comments.gmane.org/gmane.comp.apache.mod-security.user/7560
>>
>> Hi George,
>>
>> FWIW, I've had this issue when there were a very large number of audit
>> events queued to be uploaded. I ended up using Chris Bockermann's
>> excellent jwall-tools tool to temporarily upload the events instead.
>>
>> --
>> - Josh
>>
>>
>>-------------------------------------------------------------------------
>>-----
>> Free Software Download: Index, Search & Analyze Logs and other IT data
>>in
>> Real-Time with Splunk. Collect, index and harness all the fast moving
>>IT data
>> generated by your applications, servers and devices whether physical,
>>virtual
>> or in the cloud. Deliver compliance at lower cost and gain new business
>> insights. http://p.sf.net/sfu/splunk-dev2dev
>> _______________________________________________
>> mod-security-users mailing list
>> mod-security-users@...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> ModSecurity Services from Trustave's SpiderLabs:
>> https://www.trustwave.com/spiderLabs.php
>>
>
>--------------------------------------------------------------------------
>----
>Free Software Download: Index, Search & Analyze Logs and other IT data in
>Real-Time with Splunk. Collect, index and harness all the fast moving IT
>data
>generated by your applications, servers and devices whether physical,
>virtual
>or in the cloud. Deliver compliance at lower cost and gain new business
>insights. http://p.sf.net/sfu/splunk-dev2dev
>_______________________________________________
>mod-security-users mailing list
>mod-security-users@...
>https://lists.sourceforge.net/lists/listinfo/mod-security-users
>ModSecurity Services from Trustave's SpiderLabs:
>https://www.trustwave.com/spiderLabs.php
>
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.
|