I commented out debug section so that we can focus on mlogc problem:

Syntax error in config file c:\inetpub\wwwroot\owasp_crs\modsecurity.conf, line 195: ModSecurity: Failed to open the audit log pipe: c:\Program Files (x86)\ModSecurity IIS\amd64\mlogc.exe c:\Program Files (x86)\ModSecurity IIS\amd64\mlogc.conf

Relevant lines on modsecurity.conf:

SecAuditEngine On
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Concurrent
SecAuditLogStorageDir "c:\inetpub\logs\modsec\audit"

Following is line 195:

SecAuditLog "|c:\Program Files (x86)\ModSecurity IIS\amd64\mlogc.exe c:\Program Files (x86)\ModSecurity IIS\amd64\mlogc.conf"




mlogc.conf:

CollectorRoot       "c:\inetpub\logs\modsec\audit"

ConsoleURI          "https://HOST/controller/"

# Sensor credentials
SensorUsername      "user"
SensorPassword      "pass"

# Base directory where the audit logs are stored.  This can be specified
# as a path relative to the CollectorRoot, or a full path.
LogStorageDir       "c:\inetpub\logs\modsec\audit"

TransactionLog      "mlogc-transaction.log"
QueuePath           "mlogc-queue.log"
ErrorLog            "mlogc-error.log"
LockFile            "mlogc.lck"
KeepEntries         0
ErrorLogLevel       1





 Atenciosamente,

Marcus Semblano
CT - Segurança | Security Specialist
T: 11 3544-0444

Locaweb – www.locaweb.com.br
Líder em Hosting Infrastructure Services no Brasil e na América Latina em 2012, segundo a IDC


From: Marcus Semblano [marcus.semblano@locaweb.com.br]
Sent: Monday, December 23, 2013 4:17 PM
To: mod-security-users@lists.sourceforge.net
Subject: [mod-security-users] mlogc on IIS

Hi all,


I'm having a hard time making mlogc work on windows. Here is what I got:

Syntax error in config file c:\inetpub\wwwroot\owasp_crs\modsecurity.conf, line 169: Command failed to execute (check file/folder permissions, syntax, etc.).

Line 169 of modsecurity.conf:

SecDebugLog "c:\inetpub\logs\modsec"


IIS 7.5.7600.16385
Windows Server 2008 R2

Thanks for any help


 Atenciosamente,

Marcus Semblano
CT - Segurança | Security Specialist
T: 11 3544-0444

Locaweb – www.locaweb.com.br
Líder em Hosting Infrastructure Services no Brasil e na América Latina em 2012, segundo a IDC