Re: [mod-security-users] third party usage of the mod-security persistence database

[Josh Amishav-Z. <ja...@ow...>]

On Tue, Sep 3, 2013 at 10:51 PM, Dennison Williams <
den...@ra...> wrote:

> On 08/24/2013 05:40 PM, Ryan Barnett wrote:
> > You should be able to use the Jwall tools to query collections -
> > http://jwall.org/tools/jwall-tools.jsp
>
> I looked into this and this does not seem to provide any utilities for
> listing the ips that are blocked and for why.  It does have some nice
> utilities for parsing and reformatting mod_sec audit log messages.
>
>
Hi Dennison,

Regarding listing the data held within the persistant collections, try
something like (assuming your collections are stored in
/opt/modsecurity/var/data):
# jwall collections /opt/modsecurity/var/data/

--
 - Josh




> Furthur more looking at the what I think are the databases (/tmp/*pag,
> ie /tmp/ip.pag) does not show my any values when parsing those files.
> Am I looking at the wrong database files?
>
> >
> > --
> > Ryan Barnett
> >
> >
> > On Aug 24, 2013, at 8:16 PM, Dennison Williams
> > <den...@ra... <mailto:den...@ra...>>
> wrote:
> >
> >> Hello all,
> >>
> >> I would like to be able to query the mod-security persistance database
> >> to be able to answer questions about ip's that we are blocking.  I
> >> intend to do this by accessing the database directly.
> >>
> >> Is this the right way?  If not then what way is better? If this is the
> >> right way then where is the database stored?
> >>
> >> Sincerely,
> >> Dennison Williams
> >>
> >>
> ------------------------------------------------------------------------------
> >> Introducing Performance Central, a new site from SourceForge and
> >> AppDynamics. Performance Central is your source for news, insights,
> >> analysis and resources for efficient Application Performance Management.
> >> Visit us today!
> >>
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
> >> _______________________________________________
> >> mod-security-users mailing list
> >> mod...@li...
> >> <mailto:mod...@li...>
> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >> http://www.modsecurity.org/projects/commercial/rules/
> >> http://www.modsecurity.org/projects/commercial/support/
> >
> > ------------------------------------------------------------------------
> >
> > This transmission may contain information that is privileged,
> > confidential, and/or exempt from disclosure under applicable law. If you
> > are not the intended recipient, you are hereby notified that any
> > disclosure, copying, distribution, or use of the information contained
> > herein (including any reliance thereon) is strictly prohibited. If you
> > received this transmission in error, please immediately contact the
> > sender and destroy the material in its entirety, whether in electronic
> > or hard copy format.
> >
> >
> >
> ------------------------------------------------------------------------------
> > Introducing Performance Central, a new site from SourceForge and
> > AppDynamics. Performance Central is your source for news, insights,
> > analysis and resources for efficient Application Performance Management.
> > Visit us today!
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >
>
>
>
> ------------------------------------------------------------------------------
> Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
> Discover the easy way to master current and previous Microsoft technologies
> and advance your career. Get an incredible 1,500+ hours of step-by-step
> tutorial videos with LearnDevNow. Subscribe today and save!
> http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>