Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have Apache set up on a Linux server and have mod_security enabled. I have a few lines that look like:

SecRule REQUEST_URI "^/*admin" drop,phase:1

Because there is no /admin on my website, and I don't want to waste the server resources to serve a 404 page to a bot or hacker.

I've noticed that whenever a page such as /admin is visited, I see in my Apache access logs that an HTTP 301 status with 0 bytes of content was returned (which is exactly what I want). However, I also get a ModSecurity: Access denied with connection close (phase 1). Pattern match "^/*admin" at REQUEST_URI. line in my Apache error logs.

Is there any way I can continue having mod_security append these connection drops to my access logs, but not append anything to my error logs?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Make sure that you don't have log specified - from the documentation on ModSecurity:

Description: Indicates that a successful match of the rule needs to be logged.

Example:

SecAction phase:1,id:117,pass,initcol:ip=%{REMOTE_ADDR},log

This action will log matches to the Apache error log file and the ModSecurity audit log.

Instead specify nolog:

Description: Prevents rule matches from appearing in both the error and audit logs.

Example:

SecRule REQUEST_HEADERS:User-Agent "Test" allow,nolog,id:121

Although nolog implies noauditlog, you can override the former by using nolog,auditlog.

share|improve this answer
    
I can't get nolog to work. I've tried SecRule REQUEST_URI "^/*admin" drop,phase:1,nolog and SecRule REQUEST_URI "^/*admin" nolog,drop,phase:1, and yes I restarted Apache both times. The documentation doesn't say anything about using nolog and phase:# at the same time though. Could this be causing the problem? –  Mister Dood Sep 9 '13 at 0:32
    
There's an example in the docs using phase and nolog together here using SecAction, and another example here for phase. –  dan Sep 9 '13 at 1:15
    
I tried using it that way and it still didn't work. Maybe it's because of drop? –  Mister Dood Sep 9 '13 at 1:23
1  
That's really strange. Suddenly, nolog works. I'm not sure what was wrong, but all I know is that it's working now. Thanks. –  Mister Dood Sep 9 '13 at 2:30
1  
I see, thanks for the update. Lots of variables...nothing technical is ever too easy ;-) –  dan Sep 9 '13 at 4:56
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.