Re: [Mod-security-developers] Is there are a reason for phase 5 to execute prior to Apache logging?

[Brian R. <bre...@gm...>]

On Fri, Dec 11, 2009 at 10:14 AM, Ivan Ristic <iva...@gm...> wrote:
> I have a few rules that set environment variables, which are then used
> in logging (via "{VARNAME}e"), but it is impossible to set environment
> variables from ModSecurity's phase 5 before it takes place after
> Apache's logging.
>
> Is there are a reason for phase 5 to execute prior to Apache logging,
> or can we move phase 5 later?

Actually, I would rather do it after apache logging anyhow.  Right now
it does not really work to look at the log contents and this (I
think?) would allow that better.  Also, it may be better to see
Apache's error log prior to ModSecurity's as many times the Apache
error has caused the ModSecurity one (client disconnects, etc) and
this would make that a bit more clear.

-B