Re: [Owasp-modsecurity-core-rule-set] No rule-id in audit/error log with Nginx und MS3/CRS3

2016-11-25 Thread Christian Folini
Glad that's solved. Thanks for the update! Christian On Fri, Nov 25, 2016 at 11:21:04AM +0100, Muenz, Michael wrote: > Am 24.11.2016 um 17:37 schrieb Christian Folini: > >On Thu, Nov 24, 2016 at 05:02:43PM +0100, Muenz, Michael wrote: > >>SecAuditLogParts ABIJDEFHZ > >It's a little known detail

Re: [Owasp-modsecurity-core-rule-set] No rule-id in audit/error log with Nginx und MS3/CRS3

2016-11-24 Thread Christian Folini
On Thu, Nov 24, 2016 at 05:02:43PM +0100, Muenz, Michael wrote: > SecAuditLogParts ABIJDEFHZ It's a little known detail that Audit Log Parts need to be set in alphabetic order. But I do not think this is the problem here. For me, this sounds like a ModSec/NginX bug - unless you have some other

Re: [Owasp-modsecurity-core-rule-set] No rule-id in audit/error log with Nginx und MS3/CRS3

2016-11-24 Thread Muenz, Michael
Am 24.11.2016 um 16:59 schrieb Christian Folini: The interesting bit, the H part is empty. That is very odd. What is your SecAuditLogParts setting? Maybe you remove it for a test so it reverts to the default which should bring you the H audit log part. Ahoj, Christian SecAuditLogParts