It's also easy to use mod_info and review the Apache configuration, you will see the mod security rules and configuration displayed. Be sure to allow only trusted hosts/IP ranges or disable mod_info after you've checked.

The easiest manner is to monitor the modsecurity logs. In development, I configure Apache to use both methods:

 SecDebugLog logs/modsec_debug.log
 SecDebugLogLevel 1

 SecAuditEngine on
 SecAuditLog logs/modsec_audit.log I can review logs/modsec_audit.log and logs/modsec_debug.log.

Hope this helps.

Mark Lavi, Web/Surf Team @ Silicon Graphics, Inc.
[ || phone:+1-408-524-7347 ]

-----Original Message-----
From: Stephen Craig Evans []
Sent: Tue 1/27/2009 9:53 PM
To: Ivan Rodriguez
Subject: Re: [mod-security-users] mod_security2 beginner installation

Hi Ivan,

I always check to see if a ModSec configuration file is being loaded by
purposely inserting bad syntax in the *.conf file, then restarting Apache.
If Apache is picking up the conf file, Apache will not start and give you
the line number of the syntax error plus the file name.


On Wed, Jan 28, 2009 at 12:42 PM, Ivan Rodriguez <> wrote:

> Hi People I'm trying to configure mod_security2, in order to stop cross
> scripting attacks
> for an application server running Weblogic, I've compiled the module put
> the configuration in place
> inside of the virtual host I've enabled SecRuleInheritance On, I've load
> all the rules inside of the package
> set the the Maximum Debug Level, and I can't see that the mod_security is
> working
> any suggestion ? any easy way to test it ?
> Regards
> Ivan
> ------------------------------------------------------------------------------
> This email is sponsored by:
> SourcForge Community
> SourceForge wants to tell your story.
> _______________________________________________
> mod-security-users mailing list
> Commercial ModSecurity Appliances, Rule Sets and Support: