CODEWITHSUNDEEP
apachemod-security2
Dave
Dave

Reputation: 43

ModSecurity - disable logging to standard Apache error log

I'm wondering if there is some way in ModSecurity Apache2 module (version 2.9.1) how to log error messages into log file specified by the SecDebugLog option but don't duplicate them into the standard Apache error log file?

According to ModSecurity documentation the error messages are always doubled in both log files: Messages with levels 1–3 are designed to be meaningful, and are copied to the Apache’s error log. But I'd like to keep the ModSecurity stuff separate and don't mess the standard error log.

Upvotes: 1

Views: 4418

Answers (1)

Barry Pollard
Barry Pollard

Reputation: 45895

You can remove log from any of the Rules and just leave auditlog.

If using the OWASP CRS then change the default action from this:

SecDefaultAction "phase:1,deny,log"
SecDefaultAction "phase:2,deny,log"

to this:

SecDefaultAction "phase:1,deny,nolog,auditlog"
SecDefaultAction "phase:2,deny,nolog,auditlog"

Which will turn off all logging, but then turn on auditlogging again.

You may also want to add similar for phase 3 and 4 depending on whether you are also checkout outbound traffic.

However I would really, really, really caution against this for a number of reasons:

  1. You will eventually block something with a ModSecurity rule and wonder why it's happening and skip over the Audit log and blame Apache. Trust me. "Why is this request returning 403 when I can see the page exists?!?!" At least if in the error log then you've another chance to see why this is so.

  2. The entry in the error log is in one line. This makes it much easier to collect, parse and deal with errors in tools like Splunk. The audit log is spread over several lines so is less machine readable. And you should be reviewing your WAF logs regularly and not just assuming it's working correctly and only look at logs when something goes wrong. Maybe not in detail at each log level but in summary. Ivan Ristic, the original creator of ModSecurity, recently tweeted:

"If you’re not using your WAF as an IDS, you’re doing it wrong."

  1. These are errors. And the error log is therefore the right place for them. The audit log is then a useful place to get extra detail if you cannot explain the errors.

Upvotes: 2

Related Questions