Re: [mod-security-users] Blocking PUT requests

[Ivan R. <iv...@we...>]

De Vries, Richard wrote:
> Understood. Thanks for the feedback.
> 
> So there is no way to have mod_security delete these files, even though
> they triggered an alarm?

  You should be able to use "noauditlog" action to disable audit logging
  for that rule alone.


> It's important to have these attempts logged; I just don't know if we
> would actually want to keep the offending files. Especially if these are
> quite large.

  I doubt you will have that rule triggered very often. But if you really
  start getting many PUT requests you can simply set-up a cronjob to
  delete files older than X days.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall