crowdsec icon indicating copy to clipboard operation
crowdsec copied to clipboard

[appsec] `log_level` for appsec-configs loading native modsec rules is ignored

Open buixor opened this issue 11 months ago • 1 comments

What happened?

Having something like:

name: smth/rules
log_level: trace
default_remediation: ban
inband_rules:
 - smth/rules

With smth/rules being:

name: smth/rules
seclang_rules:
 - SecRuleEngine On
 - SecRequestBodyAccess On
seclang_files_rules:
  - some-native-modsec.rules 

the log_level directive seems to be ignored as I don't get info about the loading or processing of native modsec rules.

What did you expect to happen?

do not ignore log_level

How can we reproduce it (as minimally and precisely as possible)?

see sample config above

Anything else we need to know?

No response

Crowdsec version

$ cscli version
# paste output here

OS version

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Enabled collections and parsers

$ cscli hub list -o raw
# paste output here

Acquisition config

```console # On Linux: $ cat /etc/crowdsec/acquis.yaml /etc/crowdsec/acquis.d/* # paste output here

On Windows:

C:> Get-Content C:\ProgramData\CrowdSec\config\acquis.yaml

paste output here

Config show

$ cscli config show
# paste output here

Prometheus metrics

$ cscli metrics
# paste output here

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

buixor avatar Feb 04 '25 12:02 buixor

@buixor: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

  1. Check Crowdsec Documentation to see if your issue can be self resolved.
  2. You can also join our Discord.
  3. Check Releases to make sure your agent is on the latest version.
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

github-actions[bot] avatar Feb 04 '25 12:02 github-actions[bot]