Re: [mod-security-users] Strange Logs

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Ivan Ristic wrote:
> 
>> Christian Martorella wrote:
>>
>>> Hi i was trying some logs for the modsecurity Console, and i found 
>>> these entries (generated by Nikto):
>>> Why there is not Modsecurity_message?
>>> Why there is no Action?
>>
>>   modsecurity 1.9dev2 logs certain requests based only on the
>>   response status code (I will change this to be just an option before
>>   the final 1.9). So it is probably that Apache rejected
>>   those requests before they reached mod_security. You can verify
>>   this theory by looking at the debug log (at level 2 or more).
>>
> Fine, so why apache rejected those requests, before reaching the 
> modsecurity ? :)

   Because at the moment mod_security runs last, just before the
   handler is run. I am thinking about moving mod_security
   to run first, but only in v2. It's not really clear which
   option is better.

   For example, if we run very early we don't get to access Apache's
   per-context configuration (e.g. <Location>). So in order to
   retain the same functionality we have now the whole configuration
   mechanism would have to be replicated internal to modsecurity.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org