Re: [mod-security-users] Logging POST data

[Josh Amishav-Z. <ja...@ow...>]

On Mon, May 13, 2013 at 6:14 PM, azurIt <az...@po...> wrote:

> Ok, there seems to be some problem with permissions and locks:
>
>
Hi,

First thing is to enable the SecRuleEngine (SecRuleEngine On)


>
> Initialising transaction (txid UZEBs21KlY0AAATeI1IAAAAx).
> Transaction context created (dcfg 7f26d7d06bd8).
> Processing disabled, skipping (hook request_early).
> PdfProtect: Not enabled here.
> Processing disabled, skipping (hook request_late).
> Hook insert_filter: Adding PDF XSS protection output filter (r
> 7f26e1908620).
> Hook insert_filter: Processing disabled, skipping.
> Initialising logging.
> Starting phase LOGGING.
> This phase consists of 0 rule(s).
> Audit log: Logging this transaction.
> Audit log: Failed to lock global mutex: Permission denied
> Audit log: Failed to unlock global mutex: Permission denied
>

Can you try setting:
SecAuditLogType Concurrent
SecAuditLogStorageDir /some/path/to/the/audit/log/dir

and retest?

Thanks,

--
 - Josh


>
>
> I'm using Apache MPM-ITK, maybe it's related?
>
>
> azur
>
>
>
> ______________________________________________________________
> > Od: "Josh Amishav-Zlatin" <ja...@ow...>
> > Komu: azurIt <az...@po...>
> > Dátum: 13.05.2013 16:57
> > Predmet: Re: [mod-security-users] Logging POST data
> >
> > CC: "mod...@li..." <
> mod...@li...>
> >On Mon, May 13, 2013 at 5:30 PM, azurIt <az...@po...> wrote:
> >
> >> No, i didn't try to upgrade. Is there any known bug affecting POST
> logging?
> >>
> >>
> >Hi,
> >
> >Not that I know of, that was a more general comment.
> >
> >
> >> I don't know about any rules, i don't enabled any. I just wanted to log
> >> POST data for now. Thank you.
> >>
> >>
> >Can you add the following rule and set SecDebugLogLevel to 9:
> >
> >SecRule ARGS_POST ".*" "phase:2,id:1,log,msg:'Post data: %{MATCHED_VAR}'"
> >
> >Afterwards send a request with a POST body (e.g. curl -d
> >"test1=azurlt&test2=jamuse" localhost ) and send me the debug output.
> >
> >Thanks,
> >
> >--
> > - Josh
> >
> >
> >> azur
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> Learn Graph Databases - Download FREE O'Reilly Book
> >> "Graph Databases" is the definitive new guide to graph databases and
> >> their applications. This 200-page book is written by three acclaimed
> >> leaders in the field. The early access version is available now.
> >> Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
> >> _______________________________________________
> >> mod-security-users mailing list
> >> mod...@li...
> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >> http://www.modsecurity.org/projects/commercial/rules/
> >> http://www.modsecurity.org/projects/commercial/support/
> >>
> >
>
>
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and
> their applications. This 200-page book is written by three acclaimed
> leaders in the field. The early access version is available now.
> Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>