Re: [mod-security-users] Bigger test fails but chained rule is recorded in audit_log

[Ivan R. <iv...@we...>]

Dionysios G. Synodinos wrote:

> I use the following "big test":
> 
>    SecFilterSelective REMOTE_ADDR "!^148.101.211" chain
>    SecFilterSelective SCRIPT_FILENAME "(admin\.php|user\.php)$"
> 
> which restricts access to admin.php & user.php (*) from outside my LAN.
> 
> It seems that since the first filter matches for any other request from 
> the internet, it is recorded in the audit_log, even if the "big test" 
> doesn't match.
> 
> Is there a way to avoid this behaviour since it clutters my logs with 
> unneccesary information..?
> 
> I use "SecAuditEngine RelevantOnly"

   That sounds like a bug to me, so you can count on it
   being fixed before 1.8.

Bye,
Ivan