[mod-security-users] SecAuditLog format different 2.9.x and 3.0

[Cristiano G. <cri...@ga...>]

Hi!

I am using modsecurity 2.9 in apache and modsecurity 3.0 in nginx, both are in the same configuration but the log is in a different format.

My modsecurity.conf:
> SecAuditLogParts ABIJDEFGHZ
> SecAuditLogType Concurrent
> SecAuditLog /var/log/mlog2waffle/mlog2waffle-index
> SecAuditLogStorageDir /var/log/mlog2waffle/data

Events in mlog2waffle-index in modsecurity 2.9 (apache):
> http://localhost 10.10.10.10 - - [05/Mar/2018:12:33:22 --0300] "POST / HTTP/1.1" 404 926 "-" "-" Wp1jQX8AAQEAAGReP8MAAAAH "-" /20180305/20180305-1233/20180305-123322-Wp1jQX8AAQEAAGReP8MAAAAH 0 2770 md5:608e97823d44086abc1719a930fb90bb

Events in mlog2waffle-index in modsecurity 3.0 (nginx):

> 127.0.0.1 10.10.10.10 - "GET / HTTP/1.1" 404 0 - "Java/1.8.0_161" 152026763220.574250 - /var/log/mlog2waffle/data/20180305/20180305-1633/20180305-163352-152026763220.574250 0 1303.000000 md5:1a354780659b4213afc79e5185c507a7

So I can not use mlog2waffle because the format log index in 3.0 is not supported.

How can I make modsecurity 3.0 generate the logs in the 2.9.x format?


Regards,

Cristiano Galdino
cri...@ga...