search

owasp-modsecurity / ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
https://www.modsecurity.org
Apache License 2.0
8.2k stars 1.6k forks source link

ModSecurity: StatusEngine call: #1101

Closed simpleuser99 closed 8 years ago

simpleuser99 commented 8 years ago

Hello. I use CentOS 6.7 and I installed mod_security, mod_security_crs and mod_security_crs-extras from epel repo. When I started the apache I view the next message in apache error log

[Thu Mar 24 15:14:30 2016] [info] removed PID file /etc/httpd/run/httpd.pid (pid=41360) [Thu Mar 24 15:14:30 2016] [notice] caught SIGTERM, shutting down [Thu Mar 24 15:14:30 2016] [notice] ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/) >configured. [Thu Mar 24 15:14:30 2016] [notice] ModSecurity: APR compiled version="1.3.9"; loaded >version="1.3.9" [Thu Mar 24 15:14:30 2016] [notice] ModSecurity: PCRE compiled version="7.8 "; loaded >version="7.8 2008-09-05" [Thu Mar 24 15:14:30 2016] [notice] ModSecurity: LUA compiled version="Lua 5.1" [Thu Mar 24 15:14:30 2016] [notice] ModSecurity: YAJL compiled version="2.1.0" [Thu Mar 24 15:14:30 2016] [notice] ModSecurity: LIBXML compiled version="2.7.6" [Thu Mar 24 15:14:30 2016] [notice] ModSecurity: StatusEngine call: >"2.9.1,Apache,1.3.9/1.3.9,7.8/7.8 2008-09-05,Lua >5.1,2.7.6,df1b0b4c4f00dfdd93c056a1f360338d4753a694" [Thu Mar 24 15:14:30 2016] [notice] ModSecurity: StatusEngine call failed. Query: >GIXDSLRRFRAXAYLDNBSSYMJOGMXDSLZR.FYZS4OJMG4XDQLZXFY4CAMRQGA4C2MBZ.F>UYDKLCMOVQSANJOGEWDELRXFY3CYZDG.GFRDAYRUMM2GMMBQMRTGIZBZGNRTANJW.>MEYWMMZWGAZTGODEGQ3TKM3BGY4TI.1458821670.rpc.atomicorp.com [Thu Mar 24 15:14:30 2016] [notice] Apache/2.2.15 (Unix) PHP/5.5.30 configured -- resuming >normal operations [Thu Mar 24 15:14:30 2016] [info] Server built: Aug 24 2015 17:52:49 [Thu Mar 24 15:14:30 2016] [debug] prefork.c(1018): AcceptMutex: sysvsem (default: sysvsem)

I don't see Debug Log – /var/log/httpd/modsec_debug.log Audit log – /var/log/httpd/modsec_audit.log How can I resolve m problem?

zimmerle commented 8 years ago

Hi @simpleuser99,

What was the source of your package?

simpleuser99 commented 8 years ago

atomic: mirror1.34sp.com

csanders-git commented 8 years ago

You may need to contact atomic support in order to get assistance with this. It seems that you didn't install this from true EPEL. Can you show a list of your /etc/yum.repos.d/ to be sure? But it looks like you installed another repo with links to atomicorps custom compiled modsecurity that seems to have issues.

simpleuser99 commented 8 years ago

yum info mod_security Загружены модули: fastestmirror, remove-with-leaves, rhnplugin This system is receiving updates from RHN Classic or Red Hat Satellite. Loading mirror speeds from cached hostfile

simpleuser99 commented 8 years ago

Should I edit config that i view modsec_debug.log ? Or log must create from default config mod_security?

csanders-git commented 8 years ago

You are receiving a version of ModSecurity compiled by atomicorp it seems - It also seems they are maybe having issues with their engine. Remove current modsecurity and the atomic repo and redownload from the real EPEL. This will give you a non-custom compiled version.

zimmerle commented 8 years ago

I am closing this issue as this is not in ModSecurity. It is a problem in a customization made by an specific vendor. @simpleuser99 you should reach out atomicorp to explain the problem, or point their support to that issue.

simpleuser99 commented 8 years ago

Thanks. I install mod_security 2.7.3 from epel and it work.