I am trying to trace all requests being made to a website on a shared hosting server. Packet capture is just going to be too cumbersome.
We use Mod Security (2.8) with good effect, although due to the load we only have limited logging enabled
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
I don't really want to log everything for the whole server just to inspect what's going on with this one virtual host. I have tried setting
SecAuditEngine On
...inside .htaccess files and it produces a 500 internal error, with the error_log indicating those directives are not allowed in .htaccess, although, in the Modsec documentation the scope of these directives are both shown as "Any"
I have even tried creating a simple SecRule:
SecRule SERVER_NAME "example\.com" "phase:1,ctl:SecAuditEngine=On,id:123456789"
But this creates a syntax error, and it looks like SecAuditEngine or SecAuditLogRelevantStatus cannot be switched dynamically.
Does anyone know if it is possible to modify either of these two directives at transaction time per request?