Suppress loggning of "clients connected" possible ?

[frank2b]

When running the docker image the logs are quite big with "x clients connected" logging all the time. It is not that easy to get the "real" errors. Is there a way to set the log mode to "info/warning/error" ? I only found the "-d" switch for activating debug. Thx in advance /Frank

[jcmoraisjr]

Hi, this repository is only a wrapper around contrib/modsecurity from haproxy. It seems to me that this can only be changed patching the source code. I do agree that it's a bit noisy.

[dhde]

#16 will suppress this "clients connected" in logs

[KlugFR]

#16 will suppress this "clients connected" in logs

I tried to implement your patches (got your Dockerfile, patch, start.sh, then build -t the image then run it). But I have an issue, the config files don't seem to be found/read/used.

When running my built image:

# docker run --rm -p 12345:12345 david/waf
Using options: <default>
Using config files:
  - /etc/modsecurity/modsecurity.conf
  - /etc/modsecurity/owasp-modsecurity-crs.conf
1655916790.540683 [00] ModSecurity for nginx (STABLE)/2.9.5 (http://www.modsecurity.org/) configured.
1655916790.541071 [00] ModSecurity: APR compiled version="1.7.0"; loaded version="1.7.0"
1655916790.541268 [00] ModSecurity: PCRE compiled version="8.44 "; loaded version="8.44 2020-02-12"
1655916790.541451 [00] ModSecurity: YAJL compiled version="2.1.0"
1655916790.541550 [00] ModSecurity: LIBXML compiled version="2.9.14"
1655916790.541651 [00] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.

When running the original image:

# docker run --rm -p 12345:12345 quay.io/jcmoraisjr/modsecurity-spoa
Using options: <default>
Using config files:
  - /etc/modsecurity/modsecurity.conf
  - /etc/modsecurity/owasp-modsecurity-crs.conf
1655916819.173045 [00] ModSecurity for nginx (STABLE)/2.9.5 (http://www.modsecurity.org/) configured.
1655916819.173065 [00] ModSecurity: APR compiled version="1.7.0"; loaded version="1.7.0"
1655916819.173070 [00] ModSecurity: PCRE compiled version="8.44 "; loaded version="8.44 2020-02-12"
1655916819.173074 [00] ModSecurity: YAJL compiled version="2.1.0"
1655916819.173076 [00] ModSecurity: LIBXML compiled version="2.9.12"
1655916819.173113 [00] ModSecurity: StatusEngine call: "2.9.5,nginx,1.7.0/1.7.0,8.44/8.44 2020-02-12,(null),2.9.12,72"

Any idea what could be wrong?

[KlugFR]

-v /etc/modsecurity:/etc/modsecurity kind of fixes the issue, the configuration that is on the host can be used this way.