crowdsec
crowdsec copied to clipboard
[appsec] `log_level` for appsec-configs loading native modsec rules is ignored
What happened?
Having something like:
name: smth/rules
log_level: trace
default_remediation: ban
inband_rules:
- smth/rules
With smth/rules being:
name: smth/rules
seclang_rules:
- SecRuleEngine On
- SecRequestBodyAccess On
seclang_files_rules:
- some-native-modsec.rules
the log_level directive seems to be ignored as I don't get info about the loading or processing of native modsec rules.
What did you expect to happen?
do not ignore log_level
How can we reproduce it (as minimally and precisely as possible)?
see sample config above
Anything else we need to know?
No response
Crowdsec version
$ cscli version
# paste output here
OS version
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here
# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
Enabled collections and parsers
$ cscli hub list -o raw
# paste output here
Acquisition config
```console
# On Linux:
$ cat /etc/crowdsec/acquis.yaml /etc/crowdsec/acquis.d/*
# paste output here
On Windows:
C:> Get-Content C:\ProgramData\CrowdSec\config\acquis.yaml
paste output here
Config show
$ cscli config show
# paste output here
Prometheus metrics
$ cscli metrics
# paste output here
Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.
@buixor: Thanks for opening an issue, it is currently awaiting triage.
In the meantime, you can:
- Check Crowdsec Documentation to see if your issue can be self resolved.
- You can also join our Discord.
- Check Releases to make sure your agent is on the latest version.
Details
I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.