[mod-security-users] auditlog and noauditlog

[<fo...@po...>]

Hi there,

I work with a small mod_security ruleset. It's a big help when
debugging web applications.

The audit log is configured as follows:

SecFilterScanOutput   On
SecAuditLogType       Concurrent
SecAuditLogStorageDir /logs/weblogs/apache/myservice/audit_data/
SecAuditLog           /logs/weblogs/apache/myservice/audit_index.log
SecAuditLogParts      ABCDEFGHZ
SecFilterSelective    REQUEST_URI   "^/heartbeat.html"  noauditlog,pass

I want to avoid logging the loadbalancer's heartbeat request every five
second (and in  a different setup, i want the audit log to concentrate
on
a single arbitrary IP address).

Now the thing i do not understand is, that i get what i expected
in audit_index.log, but the storage dir fills up with the heartbeat
requests
nevertheless.

Is there something i missed in the documentation?

best regards,

Christian Folini