mod-security-users

[mod-security-users] tying log entries to rules

[caleb r. <Cal...@ne...>]

Hello=20


Kudos on an excellent module and kudos to ivan on the excellent o'reilly
apache security book.

When monitoring the server logs I have two questions:

1) are there any tools for monitoring the audit logs, since the output
per hit is multi line the normal approach of "grep"ing is not effective.
For example my logs are overwhelmingly phpBB exploit attempts (a bot is
doing the rounds) the noise from this in the logs is making it very
difficult to track down other "hits"=20

2) is there any way to tie down a "hit" to the rule that caught it? Once
I have identified false positives it is difficult to track down the rule
causing it, It would be useful if the log would give some form of rule
identifier for which rule caused the match=20


regards


Caleb Racey, Webteam, ISS
University of Newcastle upon Tyne

Re: [mod-security-users] tying log entries to rules

[Ivan R. <iv...@we...>]

caleb racey wrote:
> Hello 
> 
> 
> Kudos on an excellent module and kudos to ivan on the excellent o'reilly
> apache security book.

   Thanks!


> When monitoring the server logs I have two questions:
> 
> 1) are there any tools for monitoring the audit logs, since the output
> per hit is multi line the normal approach of "grep"ing is not effective.
> For example my logs are overwhelmingly phpBB exploit attempts (a bot is
> doing the rounds) the noise from this in the logs is making it very
> difficult to track down other "hits" 

   Not at the moment. In May work will begin on a web-based console to
   track the audit entries. Since for that I need to build a (Perl)
   parser I am likely to make it usable from the command line too.

   BTW, you don't have to grep access_logs either. Have a look at
   the logscan utility: http://www.apachesecurity.net/tools


> 2) is there any way to tie down a "hit" to the rule that caught it? Once
> I have identified false positives it is difficult to track down the rule
> causing it, It would be useful if the log would give some form of rule
> identifier for which rule caused the match

   There is, since yesterday, if you are not afraid to deploy 1.9dev2.
   I've just added three more actions: id, msg, severity. They are
   just plain text fields that will appear in the error message created
   by a rule.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] tying log entries to rules

[Tom A. <tan...@oa...>]

----- Original Message ----- 
From: "Ivan Ristic" <iv...@we...>
>> 1) are there any tools for monitoring the audit logs, since the output
>> per hit is multi line the normal approach of "grep"ing is not effective.
>> For example my logs are overwhelmingly phpBB exploit attempts (a bot is
>> doing the rounds) the noise from this in the logs is making it very
>> difficult to track down other "hits"
>
>   Not at the moment. In May work will begin on a web-based console to
>   track the audit entries. Since for that I need to build a (Perl)
>   parser I am likely to make it usable from the command line too.

Here's a little something I threw together:
http://orderamidchaos.com/modsec/modsec_auditlog_parser

Use it like this:
 ./modsec_auditlog_parser < /var/log/apache2/modsec_audit_log |less

Maybe it will solve the current problem of weeding through entries, and 
maybe it will help serve as the basis of a more in depth parser.  Right now 
it just grabs a few scraps of info (user agent, message, action) and sums 
them over domains.  BTW, I'm running version 1.7.6, so I don't know if the 
log has changed at all since then.  Let me know if you'd like me to do any 
tweaking for you.

Tom

Re: [mod-security-users] tying log entries to rules

[Peter W. <prw...@gm...>]

> Here's a little something I threw together:
> http://orderamidchaos.com/modsec/modsec_auditlog_parser
>=20
> Use it like this:
>  ./modsec_auditlog_parser < /var/log/apache2/modsec_audit_log |less

I wrote something similar:

http://prwdot.org/code/modsecauditlogparse.txt

But it's more quick and dirty... you are welcome to use the code if it
suits you.

Peter
--=20
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/