mod-security-users

[mod-security-users] Log question

[Tkachenko A. <al...@tk...>]

Peace be with you,


I'd like to log all php and perl requests in different logs in addition to
my usual mod_security logging.

Something like this: "Log all '.php|.phtml' -> mod_sec_php.log" and "Log all
'.cgi|.perl' -> mod_sec_perl.log".
Is it possible with mod-security tacking into account that I have usual
audit.log logging for different types of attack?

To the mod_sec_php.log and mod_sec_perl.log I'd like to log only apache
requests but not the whole information that I have in the audit_log from
mod_security.



Regards, Alexey

Re: [mod-security-users] Log question

[Ivan R. <iv...@we...>]

Tkachenko Alexei wrote:
> Peace be with you,
> 
> 
> I'd like to log all php and perl requests in different logs in addition to
> my usual mod_security logging.

   All requests? You can do that without mod_security. Something like
   this should work:

   SetEnvIf Request_URI (\.php|\.phtml|/)$ dynamic
   CustomLog logs/b92.log combined env=dynamic

-- 
Ivan Ristic (http://www.modsecurity.org)

RE: [mod-security-users] Log question

[Tkachenko A. <al...@tk...>]

Ivan, I can't use such thing.
I have hundreds of virtual hosts and can't add this "CustomLog ..." to each
of them.
Additionally I need to preserve current CustomLog setting for each
VirtualHost.

So I need to add additional logging for all requests by regexp of URL.

Also I need to preserve existing mod_security logging.
What should I place to the mod_security, is it allowed to have different
mod_security logging for different conditions?



Alexey. 


-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...] 
Sent: Monday, January 03, 2005 15:17
To: Tkachenko Alexei
Cc: mod...@li...
Subject: Re: [mod-security-users] Log question

Tkachenko Alexei wrote:
> Peace be with you,
> 
> 
> I'd like to log all php and perl requests in different logs in 
> addition to my usual mod_security logging.

   All requests? You can do that without mod_security. Something like
   this should work:

   SetEnvIf Request_URI (\.php|\.phtml|/)$ dynamic
   CustomLog logs/b92.log combined env=dynamic

--
Ivan Ristic (http://www.modsecurity.org)