Good evening, I originally posted this at http://stackoverflow.com/questions/37369990/modsecurity-error-parsing-actions-unknown-action and it was suggested to send to this listserv as well.
I'm trying to get CRS 3.0.0.-rc1 working with ModSecurity 2.9.1 and Apache 2.4.7 on an Ubuntu 14.04 machine. I'm using all the rules in the /rules directory, and when trying to start Apache I receive the following error. (Note: There is no entry in the Apache error.log file for this.) AH00526: Syntax error on line 35 of /etc/apache2/conf/crs/rules/RESPONSE-50-DATA-LEAKAGES-PHP.conf: Error parsing actions: Unknown action: \\ Action 'configtest' failed. In my troubleshooting of the *RESPONSE-50-DATA-LEAKAGES-PHP.conf *file, I combined line 35 with 34 capture,ctl:auditLogParts=+E,\ just to see if the line error would change (and make sure I was indeed troubleshooting the correct file) and suddenly this error is gone, and is replaced with another. AH00526: Syntax error on line 31 of /etc/apache2/conf/crs/rules/RESPONSE-50-DATA-LEAKAGES.conf: Error parsing actions: Unknown action: \\ which again is solved by combining with the line above it. accuracy:'9',t:none,\ Now it starts correctly with no error. Needless to say I'm pretty confused about this error, and more confused about the "fix" since I don't understand why removing a single line continuation would matter. Any thoughts on this? Or any suggestions to increase debug\troubleshooting? Thanks, David Angel
_______________________________________________ Owasp-modsecurity-core-rule-set mailing list Owasp-modsecurity-core-rule-set@lists.owasp.org https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
