Have you confirmed in the actual raw event file the the webappid data is present in section H?
Ryan C. Barnett
Director of Application Security Research
Breach Security, Inc.
From: Nicola Bianchi
To: Mod Security
Sent: Fri Dec 18 10:01:54 2009
Subject: [mod-security-users] ModSecurity Console & Group by ApplicationHi guys,we have a problem sorting the alerts on the console by application.Following the instructions in the user manual and in the new book of Ivan we have done this:<VirtualHost>....SecWebAppId MYAPP.COM....</VirtualHost>On the console when we group by application we only see APP:none.Any idea?Regards.Nick