modsecurity-crs-docker icon indicating copy to clipboard operation
modsecurity-crs-docker copied to clipboard

[QUESTION] lua m.log(2, "4444") where is the log message?

Open leveryd opened this issue 2 years ago • 5 comments

docker run --privileged --rm -ti owasp/modsecurity-crs:3.3.5-nginx-alpine-202401080101

/etc/modsecurity.d # grep SecRule setup.conf
SecRuleScript "/tmp/2.lua" "id:23333,deny"

/etc/modsecurity.d/owasp-crs # cat /tmp/2.lua
function main()
    --error("4444")
    --print("4444")
    m.log(1,"4444")
    m.log(2,"4444")
    return nil;
end

I am sure lua script have been exectued, but i checked "console output"、"nginx error log", and can not found the log message "4444".

So where is the log message?

leveryd avatar Jan 15 '24 08:01 leveryd

I had the same experience. With httpd the log message appeared in the error log, as expected, with nginx, it was nowhere to be found.

theseion avatar Jan 15 '24 11:01 theseion

Technically, this is not an issue of the images but of ModSecurity, unless Lua logging works with a standard installation. Do you know, @leveryd?

theseion avatar Jan 15 '24 11:01 theseion

@azurit do you have some experience with this problem?

fzipi avatar Feb 15 '24 13:02 fzipi

@leveryd Try adding this line before m.log: pcall(require, "m")

azurit avatar Feb 15 '24 14:02 azurit

@leveryd Try adding this line before m.log: pcall(require, "m")

It still behave the same, i can not find the log message.

leveryd avatar Mar 12 '24 08:03 leveryd