Re: [mod-security-users] Use of Modsec variable in apache access log

[Christian F. <chr...@ne...>]

HelloHomesh,

Unfortunately, this is not how this works.

A ModSecuriy variable is not automatically an environment variable.
And on top, the ModSec variable "rule" is only available during the
execution of the very rule (and there might be many, many rules).

I suggest you read up on my free tutorials published at netnea.com.
The one on logging and the ones on the Core Rule Set are proposing
ways to achieve something along these lines.

Best,

Christian


On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> Hi All,
> 
> Hope you all are well.
> 
> I want to add the modsecurity variable e.g "rule.id"in the apache access
> log via the extended format.
> I set the following line in /etc/apache2/apache.conf
> 
> LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"
> %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> 
> However I am not getting the rule.id value in the access log line.
> 
> Kindly suggest.
> 
> Thanks,
> Homesh


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/