Re: [mod-security-users] REQBODY_ERROR

[Christian F. <chr...@ti...>]

Yogesh,

As Harald pointed out, it is likely a client went away before the
full request was delivered.

The rule 200001 is rarely triggered. Unless you have a lot of
these alerts, I think it is safe to ignore it. If you do have more
of these, you need to investigate further. Possibly by raising
the LogLevel in the error-log and examining the connection.

Regs,

Christian

On Mon, Nov 23, 2015 at 07:49:46PM +0530, Yogesh Patel wrote:
> In modsecurity we have a rule below:
> 
> "SecRule REQBODY_ERROR "!@eq 0" \
> "id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse
> request body.',logdata:'%{reqbody_error_msg}',severity:2"
> 
> 
> in mod security log following error message is detected:
> 
> "Message: Access denied with code 400 (phase 2). Match of "eq 0"
> against "REQBODY_ERROR" required. [file
> "D:/tools/Apache2.4.x/conf/extra/highq/modsec/modsecurity.conf"] [line
> "132"] [id "200001"] [msg "Failed to parse request body."] [data
> "Error reading request body: Client went away."] [severity "CRITICAL"]
> Action: Intercepted (phase 2)"
> 
> 
> What could be the possible reason for this error?
> 
> 
> -- 
> *Thanks & Regards,*
> 
> * Yogesh Patel*

> ------------------------------------------------------------------------------
> Go from Idea to Many App Stores Faster with Intel(R) XDK
> Give your users amazing mobile app experiences with Intel(R) XDK.
> Use one codebase in this all-in-one HTML5 development environment.
> Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
> http://pubads.g.doubleclick.net/gampad/clk?id=254741551&iu=/4140

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/