Have you confirmed in the actual raw event file the the webappid data is present in section H?


Ryan C. Barnett
Director of Application Security Research
Breach Security, Inc.
Ryan.Barnett@Breach.com
www.Breach.com


From: Nicola Bianchi
To: Mod Security
Sent: Fri Dec 18 10:01:54 2009
Subject: [mod-security-users] ModSecurity Console & Group by Application

Hi guys,
we have a problem sorting the alerts on the console by application.

Following the instructions in the user manual and in the new book of Ivan we have done this:

 <VirtualHost>
  ....
    SecWebAppId MYAPP.COM
  ....
  </VirtualHost>

On the console when we group by application we only see APP:none.
Any idea?

Regards.
  Nick