Re: [mod-security-users] Problem executing PHP script as filter action

[Ivan R. <iva...@gm...>]

>
> I increased the dubug level to 9 and there were no error messages, just i=
t's
> normal stuff.

There should be a line that begins with "sec_exec_child: First line
from script output". Can you find it? What does it say?

> Ultimately the script will do much more than send an email, but I figure
> that's a good place to start.

I am not sure that is such a good idea. What will happen when you get
100 attacks per second? Even if you build a throttling mechanism your
box is going to have difficulties starting 100 binaries per second. :)

A safer approach is to observe the audit log entries from a single process.

--
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall