2

I have a specific URL that keeps getting checked by weird bots, and that keeps triggering ModSecurity rules that fill up my logs. I would like to disable logging for that one specific URL to make it easier to review my logs, but continue blocking the bots.

Here is what I have done so far, but the logging is continuing:

SecRule REQUEST_URI "@beginsWith /widget-info-forum/" \
    "id:100100,\
    nolog"

For anyone interested in the log, these are the type of things triggering the rule, a bot with "Accept-Encoding header exceeded sensible length":

---VJ89OzEF---A--
[14/Nov/2022:02:30:08 +0000] 166839300825.789080 185.25.35.15 38913 ***.***.***.*** 443
---VJ89OzEF---B--
GET /widget-info-forum/external.php?type=RSS2&forumids=20 HTTP/1.1
If-Modified-Since: Sun, 06 Nov 2022 00:00:00 UTC
Accept-Encoding: gzip;q=1.0, deflate;q=0.8, chunked;q=0.6, identity;q=0.4, *;q=0
Host: www.*************.com
Connection: Keep-Alive
User-Agent: magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)

---VJ89OzEF---E--
<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a

---VJ89OzEF---F--
HTTP/1.1 403
Server: nginx
Date: Mon, 14 Nov 2022 02:30:08 GMT
Content-Length: 146
Content-Type: text/html
Connection: keep-alive

---VJ89OzEF---H--
ModSecurity: Warning. Matched "Operator `Gt' with parameter `50' against variable `REQUEST_HEADERS:Accept-Encoding' (Value: `gzip;q=1.0, deflate;q=0.8, chunked;q=0.6, identity;q=0.4, *;q=0' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1148"] [id "920520"] [rev ""] [msg "Accept-Encoding header exceeded sensible length"] [data "63"] [severity "2"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "***.***.***.***"] [uri "/widget-info-forum/external.php"] [unique_id "166839300825.789080"] [ref "v132,63t:lowercase,t:length"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "***.***.***.***"] [uri "/widget-info-forum/external.php"] [unique_id "166839300825.789080"] [ref ""]






---agLbPHY1---A--
[14/Nov/2022:02:22:17 +0000] 166839253741.744390 185.25.35.8 36994 ***.***.***.*** 443
---agLbPHY1---B--
GET /widget-info-forum/forumdisplay.php?f=500 HTTP/1.1
If-Modified-Since: Tue, 08 Nov 2022 00:00:00 GMT
Accept-Encoding: gzip;q=1.0, deflate;q=0.8, chunked;q=0.6, identity;q=0.4, *;q=0
Host: www.*************.com
Connection: Keep-Alive
User-Agent: magpie-crawler/1.1 (U; Linux amd64; en-GB; +http://www.brandwatch.net)

---agLbPHY1---E--
<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a

---agLbPHY1---F--
HTTP/1.1 403
Server: nginx
Date: Mon, 14 Nov 2022 02:22:17 GMT
Content-Length: 146
Content-Type: text/html
Connection: keep-alive

---agLbPHY1---H--
ModSecurity: Warning. Matched "Operator `Gt' with parameter `50' against variable `REQUEST_HEADERS:Accept-Encoding' (Value: `gzip;q=1.0, deflate;q=0.8, chunked;q=0.6, identity;q=0.4, *;q=0' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1148"] [id "920520"] [rev ""] [msg "Accept-Encoding header exceeded sensible length"] [data "63"] [severity "2"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "***.***.***.***"] [uri "/widget-info-forum/forumdisplay.php"] [unique_id "166839253741.744390"] [ref "v120,63t:lowercase,t:length"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "***.***.***.***"] [uri "/widget-info-forum/forumdisplay.php"] [unique_id "166839253741.744390"] [ref ""]
Improve this question

1 Answer 1

Reset to default
4

CRS Dev-On-Duty here. By setting the action nolog you only disable logging for this new rule with id:100100, not for ModSecurity in general.

But you can disable Audit Logging with the control statement ctl:auditEngine=Off:

SecRule REQUEST_URI "@beginsWith /widget-info-forum/" \
    "id:100100,\
    phase:1,\
    pass,\
    nolog,\
    ctl:auditEngine=Off"

You will still get the entries in the error.log, but no longer in the audit.log.

I'm not aware of any way to disable error.log for a specific rule.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .