4

In my modsecurity auditlog there is a binary file logged as text: enter image description here

How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?

Improve this question
2
  • One of the solutions will be looking for iso (or other binary) files in the REQUEST_HEADERS:Content-Disposition and then exclude the request from getting logged through nolog option.
    – void_in
    Commented Sep 5, 2017 at 6:46
  • Although I haven't used modsecurity, there's probably an option to escape unprintable characters.
    – forest
    Commented Sep 15, 2018 at 3:01

1 Answer 1

Reset to default
0

You can use @validateByteRange to look for those characters that may cause you issues to drop the request body C part from the auditlog but do that after doing your basic filtering (OWASP CRS + positive filtering) so you can make sure you are not dropping important logs.

SecRule REQUEST_BODY|ARGS "@validateByteRange 9,10,13,32-126,128-255" \
    "id:666,\
    phase:2,\
    pass,\
    t:none,t:urlDecodeUni,\
    msg:'Invalid character in request (non printable characters) dropping request body',\
    severity:'INFO',\
    setvar:'tx.msg=%{rule.msg}',\
    ctl:auditLogParts=-C"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .