Why is my SecAction rule being ignored?

Question

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg is not printed either on access.log or error.log.

SecAction \
    "id:980145,\
    phase:5,\
    pass,\
    t:none,\
    log,\
    noauditlog,\
    msg:\'Incoming Anomaly Score: %{TX.ANOMALY_SCORE}\'"

I tried messing with the CRS rules just to see if I could change an existing rule and the changes where effective printing a different message than the original on the error.log, but the rule above is ignored. I think the place is so obvious it's not even mentioned on the tutorial, but I'm a newbie.

Checking the Debug Log level 9 I could see the following:

grep 980145 /var/log/modsec_debug.log

[1630420852] [/image/top.jpg] [4] (Rule: 980145) Executing unconditional rule...
[1630420852] [/image/top.jpg] [4] (Rule: 980145) Executing unconditional rule...

But if I grep the error log for the 980145 id, nothing is printed there.

Server:

• nginx 1.20.1
• modsecurity 3
• owasp-modsecurity-crs 3.0.0

What is the appropriate .conf file and place I should include this rule so that it's not ignored by ModSecurity when processing the rules?

Answer 1

The problem was the directive error_log on the nginx.conf file.

The options are debug, info, notice, warn, error, crit, alert, or emerg. It is configured for notice by defaul and that message from the rule 980145 is considered info for Nginx. I replaced it with the info option and it printed the message as follow on the error.log file:

2021/09/14 17:36:40 [info] 23969#23969: *104083 ModSecurity: Warning ...... [msg "Incoming Anomaly Score: 0"]
2021/09/14 17:36:40 [info] 23969#23969: *104083 ModSecurity: Warning ...... [msg "Incoming Anomaly Score: 0"]
2021/09/14 17:36:40 [info] 23969#23969: *104083 ModSecurity: Warning ...... [msg "Incoming Anomaly Score: 0"]