Is there a way to check how much time to go over all rules in modsecurity

owasp-modsecurity / ModSecurity-nginx

ModSecurity v3 Nginx Connector

Apache License 2.0

1.48k stars 274 forks source link

Is there a way to check how much time to go over all rules in modsecurity #288

Closed jingzhao-self closed 1 year ago

jingzhao-self commented 1 year ago

Hi team, Right now I have some performance issues after modsecurity is on, and don't know how to get process time of modsecurity rules on each http request, is there a way to show it? I have checked $request_time in nginx log but it seems not include modsecurity process time. Thanks

airween commented 1 year ago

May be it can help (and may be cannot), there is a tool: ftwrunner (there is a beta version of new release).

It uses the test case format of CRS. With this, you can make a request in that format, and can measure the runtime. Also you can remove rules, if you are sure those aren't effected.

martinhsv commented 1 year ago

Hello @jingzhao-self ,

WIth ModSecurity v3, there are a few options, one of the simplest is using the DURATION variable. Outputting that value at selected points in your rule set can help narrow down where your most substantial performance issues are.

Another tool (besides the one already mentioned above) that you could consider experimenting with is referenced here: https://github.com/SpiderLabs/ModSecurity/issues/1011#issuecomment-337212177