Have you confirmed in the actual raw event file the the webappid data is present in section H?
Ryan C. Barnett
Director of Application Security Research
Breach Security, Inc.
From: Nicola Bianchi
To: Mod Security
Sent: Fri Dec 18 10:01:54 2009
Subject: [mod-security-users] ModSecurity Console & Group by Application
we have a problem sorting the alerts on the console by application.
Following the instructions in the user manual and in the new book of Ivan we have done this:
On the console when we group by application we only see APP:none.