I'm quite sure the phase is the issue. I run the log with Debug 9, just
pasted here a "cleaned up" version. Setting the phase to 1 in my custom
rules causes the anomaly score to reset in REQUEST-901-INITIALIZATION.conf
I'll investigate further
Il 05/12/2017 11:10, Christian Folini ha scritto:
Cristian,
You are getting there. Yet the DebugLogLevel is still not high enough.
Put it to 9and then you grep for the threshold variable in the logfile.
This will allow you to see which rule sets the threshold and in what order.
It is possible it's a phase issue. But when I looked over it in your
previous message the suspicion was not confirmed. But I am not ruling it out.
Ahoj,
Christian
_______________________________________________
Owasp-modsecurity-core-rule-set mailing list
Owasp-modsecurity-core-rule-set@lists.owasp.org
https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
