In my modsecurity auditlog there is a binary file logged as text: enter image description here

How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?

  • One of the solutions will be looking for iso (or other binary) files in the REQUEST_HEADERS:Content-Disposition and then exclude the request from getting logged through nolog option. – void_in Sep 5 '17 at 6:46
  • Although I haven't used modsecurity, there's probably an option to escape unprintable characters. – forest Sep 15 '18 at 3:01

You can use @validateByteRange to look for those characters that may cause you issues to drop the request body C part from the auditlog but do that after doing your basic filtering (OWASP CRS + positive filtering) so you can make sure you are not dropping important logs.

SecRule REQUEST_BODY|ARGS "@validateByteRange 9,10,13,32-126,128-255" \ "id:666,\ phase:2,\ pass,\ t:none,t:urlDecodeUni,\ msg:'Invalid character in request (non printable characters) dropping request body',\ severity:'INFO',\ setvar:'tx.msg=%{rule.msg}',\ ctl:auditLogParts=-C"

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.