[mod-security-users] Bigger test fails but chained rule is recorded in audit_log

[Dionysios G. S. <ds...@no...>]

I use the following "big test":

    SecFilterSelective REMOTE_ADDR "!^148.101.211" chain
    SecFilterSelective SCRIPT_FILENAME "(admin\.php|user\.php)$"

which restricts access to admin.php & user.php (*) from outside my LAN.

It seems that since the first filter matches for any other request from 
the internet, it is recorded in the audit_log, even if the "big test" 
doesn't match.

Is there a way to avoid this behaviour since it clutters my logs with 
unneccesary information..?

I use "SecAuditEngine RelevantOnly"

-dsin

(*) I also use mod_access for that after Ivan's suggestion