I have Apache set up on a Linux server and have mod_security enabled. I have a few lines that look like:
SecRule REQUEST_URI "^/*admin" drop,phase:1
Because there is no
/admin on my website, and I don't want to waste the server resources to serve a 404 page to a bot or hacker.
I've noticed that whenever a page such as
/admin is visited, I see in my Apache access logs that an HTTP 301 status with 0 bytes of content was returned (which is exactly what I want). However, I also get a
ModSecurity: Access denied with connection close (phase 1). Pattern match "^/*admin" at REQUEST_URI. line in my Apache error logs.
Is there any way I can continue having mod_security append these connection drops to my access logs, but not append anything to my error logs?