0

I want to print mod_security anomaly score to apache error log. I use setenv to set enviroment variable, and %{name}e syntax to print it in log.

Modsecurity config:

SecAction "id:90100,phase:5,pass, nolog, setenv:ModSecAnomalyScoreIn=%{tx.anomaly_score}, setenv:ModSecAnomalyScoreOut=%{TX.outbound_anomaly_score}"

Apache config:

ErrorLogFormat "[...] [anomaly_score_in: %-{ModSecAnomalyScoreIn}e, anomaly_score_out: %-{ModSecAnomalyScoreOut}e ]"

But the output is empty: [...] [anomaly_score_in: -, anomaly_score_out: - ]

If I add SecAction "id:9990101,phase:5,pass, log, msg:'in: %{env.anomaly_score}, out: %{env.ModSecAnomalyScoreOut}', scores are printed, but in new log line.

Where did I go wrong?

Does the %{name}e in ErrorLogFormat is equal to %{VARNAME}e in mod_log_config?

Vladimir
  • 31
  • 1
  • 6
  • Read http://httpd.apache.org/docs/2.4/mod/mod_log_config.html#customlog and http://httpd.apache.org/docs/2.4/mod/mod_log_config.html#formats, and perhaps some more of the `mod_log_config` documentation – Colt Aug 16 '17 at 12:46

1 Answers1

0

Why do you have a dash between the % and the { in the first non-working example?

Also the Modsecurity reference manual says you should use %{modsecurity_variable_name}M instead of %{modsecurity_variable_name}e.

So I believe your final config should be:

ErrorLogFormat "[...] [anomaly_score_in: %{ModSecAnomalyScoreIn}M, anomaly_score_out: %{ModSecAnomalyScoreOut}M ]"

Note also that custom ErrorLogFormats only work with ModSecurity 2.9.1 or above: https://github.com/SpiderLabs/ModSecurity/pull/840

Barry Pollard
  • 4,461
  • 14
  • 26
  • Hi! Output: `[anomaly_score_in: [client ...] ModSecurity: Warning. detected SQLi using libinjection with fingerprint...` . It seems that `%{something}M` works only in `LogFormat`, not in `ErrorLogFormat`. – Vladimir Aug 22 '17 at 02:25
  • Probably, apache handles this - `ErrorLogFormat "[...] [anomaly_score_in: %{ModSecAnomalyScoreIn}M` like this `ErrorLogFormat "[...] [anomaly_score_in: %M`, and prints "actual log message". – Vladimir Aug 22 '17 at 07:16