Hello I'm using libmodsecurity (4e6e4243|v3.0.3) on nginx(1.15.12) with the connector being the current master (d7101e13685) and OWASP CRS on (ab24a20faf28156f0|v3.1.0).
I am trying to log the POST request body (C part in modsecurity) on a specific URL with something akin to the following rule:
SecRule REQUEST_URI "/some_url/processor.php" \
"id:66600001,\
phase:2,\
t:none,\
log,\
ctl:auditLogParts=ABCIJDEFHZ,\
pass"
which results on nginx not starting with the following error:
Expecting an action, got: ctl:auditLogParts=ABCIJDEFHZ,\
I've tried multiple variations of the ctl, including ctl:auditLogParts=ABCFHZ
and ctl:auditLogParts=AC
. All throwing the same error.
Curiously doing it with ctl:auditLogParts=+C
allows nginx to start but unfortunately the audit log does not show the request body of the POST, actually it shows nothing.
Of course changing the SecAuditLogParts config in modsecurity.conf from ABIJDEFHZ
(default) to ABCIJDEFHZ
changes the logging but makes us non compliant on a shitload of rules.