mod-security-users

[mod-security-users] Logging-Questions

[Jens W. <jen...@je...>]

Hi,

two questions about the logging in mod_Security :)

- how can I get an audit-logentry for "log,pass"-action? I only get an entry in
the error_log
- is there a way to get two audit-logs? One relevant-only and the other with all
requests?


-- 
Jens

Re: [mod-security-users] Logging-Questions

[Ivan R. <iv...@we...>]

Jens Weibler wrote:
> Hi,
> 
> two questions about the logging in mod_Security :)
> 
> - how can I get an audit-logentry for "log,pass"-action? I only get an entry in
> the error_log

   That does not appear to work properly in 1.8.7. It is already fixed
   in 1.9, but I will check it once more before the final release (should
   be out by the end of July).


> is there a way to get two audit-logs? One relevant-only and the other
 > with all requests?

   At the moment, no. Why do you need that for? Audit logging is
   I/O intensive operation as it is, I imagine having multiple logs
   would bring a web server down to a crawl.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Logging-Questions

[Jens W. <sha...@no...>]

Quoting Ivan Ristic <iv...@we...>:

> Jens Weibler wrote:

>> is there a way to get two audit-logs? One relevant-only and the other
> > with all requests?
>
>   At the moment, no. Why do you need that for? Audit logging is
>   I/O intensive operation as it is, I imagine having multiple logs
>   would bring a web server down to a crawl.

I'm using modSecurity for an application-layer hacking-contest (CTF) [1] as an
audit- and blocking-tool.
I want to have a complete audit-log for later inspection/analysis but also an
attack-only log which I read while the contest is running.


btw: modSecurity was a great help at the last contest and helped us to get in
the TOP3 :)

[1] http://www.cs.ucsb.edu/~vigna/CTF/ and in a few weeks
http://www-i4.informatik.rwth-aachen.de/~lexi/cipher.php?edit=0

-- 
Jens