How to make lua script or nginx-plugin to send modsec-audit.log to redis not file transformer

xx-zhang commented 11 months ago

How to make lua script or nginx-plugin to send modsec-audit.log to redis not file transformer .

transform modsec-audit log when log is produce and not to file that dicrect to redis pipeline .

One2r commented 11 months ago

You can use:

SecAuditLogType HTTPS
SecAuditLog http://xxx.xxx.xxx.xxx:port

xx-zhang commented 10 months ago

@One2r 你确定这个可以搞？有没有详细的文档，我还是倾向看看能不能用 lua 发送，我的nginx access_log 就是，但是我不管怎么设置，都获取不到 ngx.var.modsec* 相关的变量，主要是 message 获取不到。

One2r commented 10 months ago

可以的，审计日志发送到http接口，解析后想干嘛就干嘛。

xx-zhang commented 10 months ago

可以的，审计日志发送到http接口，解析后想干嘛就干嘛。

@One2r 毛的，我配置了一点反应都没有. sender_log 对应的就是 post请求。都没过去。 modsecurity308 - nginx1.24.0 - modsecurity-nginx103

SecRuleEngine on
SecRequestBodyAccess on

SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyLimitAction Reject

SecPcreMatchLimit 100000
SecPcreMatchLimitRecursion 100000

SecResponseBodyAccess on
SecResponseBodyMimeType text/plain text/html text/xml
SecResponseBodyLimit 1048576
SecResponseBodyLimitAction ProcessPartial

SecTmpDir /tmp/
SecDataDir /tmp/

SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABCIJDEFHZ
#SecAuditLogParts ABCIFHZ

#SecAuditLogType Serial
#SecAuditLogFormat JSON

SecAuditLogType HTTPS
SecAuditLog http://127.0.0.1:7788/sender_log

#SecAuditLog var/logs/modsec_audit.log

SecArgumentSeparator &
SecCookieFormat 0
SecUnicodeMapFile unicode.mapping 20127
SecStatusEngine On

One2r commented 10 months ago

看看该安装的依赖库都安装了没，libcurl，libyajl这些。可以开debug看看日志

xx-zhang commented 10 months ago

看看该安装的依赖库都安装了没，libcurl，libyajl这些。可以开debug看看日志

@One2r json log, 还是原文格式的都没问题，文本正常产生。这些依赖包肯定都没问题。我还是用 Modsecurity SecAction + lua脚本算了。有时间再看看debug:9 有没有问题了，

owasp-modsecurity / ModSecurity-nginx

How to make lua script or nginx-plugin to send modsec-audit.log to redis not file transformer #308