Re: [mod-security-users] Newbie questions, please help

[Ofer S. <OferS@Breach.com>]

> Michael David wrote:
>=20
> I'm a new user of mod security, still usng detection only mode. I see
> these in my apache error_log, what do they mean?
>=20
> 1: ModSecurity: Regex processing failed: (null)

This denotes is an error in a regular expression in a rule. The latest
version of ModSecurity would refuse to load with a faulty regular
expression and would pinpoint the problematic rule. Are you using the
latest version (2.0.3 at least)?

>=20
> 2: ModSecurity: Audit log: Failed to lock global mutex: Permission
denied
>=20
> 3: ModSecurity: Audit log: Failed to unlock global mutex: Permission
> denied

I think that this is a bug that was solved also in the latest release.

>=20
> 4: ModSecurity: Warning. Pattern match
>
"(?:\\\\b(?:.(?:ht(?:access|passwd|group)|www_?acl)|global.asa|httpd.con
f|
> boot.ini)\\\\b|\\\\/etc\\\\/)" at REQUEST_FILENAME.
>=20
> 5: ModSecurity: Warning. Pattern match "\\\\b(?:google(?:-
> sitemaps|bot)|mediapartners-google)\\\\b" at
REQUEST_HEADERS:User-Agent.
> (Is this googlebot?)
>=20

This are the events that ModSecurity issues. The 1st might be an attack
attempt, and the 2nd one points out the Google indexed your site.

> Again, I'm a brand new user, please excuse the newbie questions.
>=20

We are here to help

~ Ofer