Are these transactions false positives? Should they not be logged for another reason?

They are only transactions, every users that connect to our site make a log for any connection, this means many and many logs for every connection; after one month of modsecurity, we have 10GB of mysql DB!

Hi Daniele,

It sounds like you have a large number of false positives. I recommend tuning your ruleset. Ryan wrote a great blog post about that here:

Contact me privately if you need assistance

Hi Josh. 

Thanks, but they aren't false positive, they are simply all the transactions; they are marked with a white flag, while the alarms are marked with a red flag. 

Daniele Gallarato
Gli animali sono miei amici...e io non mangio i miei amici.

-- George Bernard Shaw

-- --