[mod-security-users] Make rule log instead of block at runtime

[Dominik S. <Dom...@sy...>]

Hi there,

I can whitelist a rule (e. g., from the CRS) for a specific URL like so:

SecRule REQUEST_URI "@beginsWith /fileupload/" "id:1920120,phase:1,nolog,pass,ctl:ruleRemoveById=920120"

Is there a way to not remove the rule entirely, but just make it log instead of block? The only way I found was to copy and doctor the entire rule, which is hard to maintain.

The use case is: Users sometimes upload files with weird names. I want to allow this, but still see it in the logs.

Many thanks,
Dominik

-- 
Unsere Grundsätze zur Datenverarbeitung finden Sie unter: https://www.syracom.de/footernavi/grundsaetze-der-datenverarbeitung-bei-der-syracom-ag.html