Hi Ivan,

This is the version that is reported in the bottom left corner "ModSecurity Console 1.0.4 (25 April 2007)".  The alerts we are getting are usually due to automated scripts trying to
comment spam our sites and they have long request bodies.  Could they be posting bodies too long for the console to handle?

---

Vince                   |  Michael Smith Laboratories
Systems Network Manager |  University of British Columbia

Ivan Ristic wrote:
You are probably experiencing problems with alerts that have a request
body. That's weird if you are running 1.0.4 because it's a problem we
detected in 1.0.3 and fixed (supposedly) in 1.0.4. Maybe it's a
different problem. Does the version number in the bottom left corner
say 1.0.4?

On Tue, Apr 29, 2008 at 1:10 AM, Vince <vtingey@msl.ubc.ca> wrote:
  
 Hi Brian,

 Sorry, I totally forgot to mention that I am running the latest version of
the console (1.0.4).  One thing I have not done is try to upgrade my mlogc
as I'm still running older versions of mod_security on my two web servers.
Should I try to upgrade my mod_security on my web servers too?

 Thanks!

 Vince | Michael Smith Laboratories
Systems Network Manager | University of British Columbia





 Brian Rectanus wrote:
 Try upgrading to 1.0.4 and this should solve the issue.

-B

Vince wrote:


 Hi Everyone!

I have a problem viewing certain alerts in the mod_security console.
Sometimes I get a "500 Internal Server Error". I looked in the mailing
list history and found some people getting this error when generating
reports and it was due to using the Red Hat JRE which we were using. I
removed that JRE and installed the new Sun JRE version 6
(jdk-1.6.0_06-fcs). The 'rawPart' method error in my debug.log.0 keeps
coming up whenever I have the internal server error.

Here are snippets of my stderr.log and my debug.log.0 files.

----------------------------------------
debug.log.0:
----------------------------------------

Apr 28, 2008 1:08:16 PM com.thinkingstone.console.web.DispatcherServlet
service
SEVERE: Error processing web application request.
org.apache.velocity.exception.MethodInvocationException: Invocation of
method 'rawPart' in class com.thinkingstone.web.FormatTool
 threw exception class java.lang.NullPointerException : null
 at
org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:246)
 at
org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:175)
 at
org.apache.velocity.runtime.parser.node.ASTReference.render(ASTReference.java:220)
 at
org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:55)
 at
org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:230)
 at
org.apache.velocity.runtime.parser.node.ASTIfStatement.render(ASTIfStatement.java:89)
 at
org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:55)
 at
org.apache.velocity.runtime.parser.node.ASTIfStatement.render(ASTIfStatement.java:70)
 at
org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:230)
 at org.apache.velocity.Template.merge(Template.java:256)
 at com.thinkingstone.web.VelocityView.render(Unknown Source)
 at
com.thinkingstone.console.web.DispatcherServlet.render(Unknown Source)
 at
com.thinkingstone.console.web.DispatcherServlet.service(Unknown Source)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
 at
org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:427)
 at
org.mortbay.jetty.servlet.ServletHandler.dispatch(ServletHandler.java:666)
 at
org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:568)
 at org.mortbay.http.HttpContext.handle(HttpContext.java:1565)
 at org.mortbay.http.HttpContext.handle(HttpContext.java:1517)
 at org.mortbay.http.HttpServer.service(HttpServer.java:954)
 at org.mortbay.http.HttpConnection.service(HttpConnection.java:816)
 at
org.mortbay.http.HttpConnection.handleNext(HttpConnection.java:983)
 at org.mortbay.http.HttpConnection.handle(HttpConnection.java:833)
 at
org.mortbay.http.SocketListener.handleConnection(SocketListener.java:244)
 at org.mortbay.util.ThreadedServer.handle(ThreadedServer.java:357)
 at org.mortbay.util.ThreadPool$PoolThread.run(ThreadPool.java:534)

----------------------------------------
stderr.log
----------------------------------------

Velocity message: 1
**************************************************************
Velocity message: 1 Starting Jakarta Velocity v1.4
Velocity message: 1 RuntimeInstance initializing.
Velocity message: 1 Default Properties File:
org/apache/velocity/runtime/defaults/velocity.properties
Velocity message: 1 Default ResourceManager initializing. (class
org.apache.velocity.runtime.resource.ResourceManagerImpl)
Velocity message: 1 Resource Loader Instantiated:
org.apache.velocity.runtime.resource.loader.FileResourceLoader
Velocity message: 1 FileResourceLoader : initialization starting.
Velocity message: 1 FileResourceLoader : adding path
'/opt/modsecurity-console/var/data/main/console/velocity/'
Velocity message: 1 FileResourceLoader : initialization complete.
Velocity message: 1 ResourceCache : initialized. (class
org.apache.velocity.runtime.resource.ResourceCacheImpl)
Velocity message: 1 Default ResourceManager initialization complete.
Velocity message: 1 Loaded System Directive:
org.apache.velocity.runtime.directive.Literal
Velocity message: 1 Loaded System Directive:
org.apache.velocity.runtime.directive.Macro
Velocity message: 1 Loaded System Directive:
org.apache.velocity.runtime.directive.Parse
Velocity message: 1 Loaded System Directive:
org.apache.velocity.runtime.directive.Include
Velocity message: 1 Loaded System Directive:
org.apache.velocity.runtime.directive.Foreach
Velocity message: 1 Created: 20 parsers.
Velocity message: 1 Velocimacro : initialization starting.
Velocity message: 1 Velocimacro : adding VMs from VM library template :
VM_global_library.vm
Velocity message: 3 ResourceManager : unable to find resource
'VM_global_library.vm' in any resource loader.
Velocity message: 1 Velocimacro : error using VM library template
VM_global_library.vm :
org.apache.velocity.exception.ResourceNotFoundException: Unable to find
resource 'VM_global_library.vm'
Velocity message: 1 Velocimacro : VM library template macro
registration complete.
Velocity message: 1 Velocimacro : allowInline = true : VMs can be
defined inline in templates
Velocity message: 1 Velocimacro : allowInlineToOverride = true : VMs
defined inline may replace previous VM definitions
Velocity message: 1 Velocimacro : allowInlineLocal = false : VMs defined
inline will be global in scope if allowed.
Velocity message: 1 Velocimacro : messages on : VM system will output
logging messages
Velocity message: 1 Velocimacro : autoload off : VM system will not
automatically reload global library macros
Velocity message: 1 Velocimacro : initialization complete.
Velocity message: 1 Velocity successfully started.
Velocity message: 1 ResourceManager : found adminHome.vm with loader
org.apache.velocity.runtime.resource.loader.FileResourceLoader
Velocity message: 1 ResourceManager : found _header.vm with loader
org.apache.velocity.runtime.resource.loader.FileResourceLoader
Velocity message: 1 ResourceManager : found _footer.vm with loader
org.apache.velocity.runtime.resource.loader.FileResourceLoader
Velocity message: 1 ResourceManager : found index.vm with loader
org.apache.velocity.runtime.resource.loader.FileResourceLoader
Velocity message: 1 ResourceManager : found viewAlertsGroup.vm with
loader org.apache.velocity.runtime.resource.loader.FileResourceLoader
Velocity message: 1 ResourceManager : found viewTransaction.vm with
loader org.apache.velocity.runtime.resource.loader.FileResourceLoader
Velocity message: 3 Method rawPart threw exception for reference $format
in template viewTransaction.vm at [69,17]

----------------------------------------

Thanks alot for the help!

--

Vince | Michael Smith Laboratories
Systems Network Manager | University of British Columbia





-------------------------------------------------------------------------
 This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
 Don't miss this year's exciting event. There's still time to save $100.
 Use priority code J8TL2D2.

http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
 mod-security-users mailing list
 mod-security-users@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/mod-security-users