search

owasp-modsecurity / ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
https://www.modsecurity.org
Apache License 2.0
8.26k stars 1.61k forks source link

allow logging to systemd journal #2506

Open adrelanos opened 3 years ago

adrelanos commented 3 years ago

SecAuditLog currently does not allow logging to systemd journal. Or at least that's not documented.

Could you please allow logging to systemd journal?

Might be simple to implement. For example any daemon written in bash just has to do echo message and that will end up in systemd journal. No very special code required in ModSecurity. Just write to stdout/stderr normally. Perhaps SecAuditLog stdout?

Another option might be supporting SecAuditLog /dev/log but /dev/log is not a file, it's a unix domain socket file.

zimmerle commented 3 years ago

@adrelanos v3 is safe to output the logs to /dev/stdout. Have you faced any issues by doing that?

adrelanos commented 3 years ago

I wouldn't know why that wouldn't be safe. Lots of daemons doing that.

SecAuditLog /dev/stdout however doesn't work. Nothing ends up in journal.

zimmerle commented 3 years ago

Can you perform a test with the DebugLogs? I am going to check the AuditLogs here as well.

hwgao commented 2 years ago

My test result:

  1. Set SecDebugLog /dev/stdout. Got the error when reloading Nginx: "Failed to start DebugLog: Failed to open file: /dev/stdout".
  2. Set SecAuditLog /dev/stdout. There is no audit log in systemd journal.
florianheiny commented 2 years ago

SecAuditLogType Serial SecAuditLog /dev/stdout

also gives me the error ModSecurity: Failed to open the audit log file: /dev/stdout

hwgao commented 2 years ago

It will be better if it is possible to set SecAuditLog to a Unix domain socket. I have tried to add setting CURLOPT_UNIX_SOCKET_PATH in /src/utils/https_client.cc and do something simple change. But the connection to the socket is failed with "Download failed: Couldn't connect to server" shown in debug log. I can see "Sending log to: /dev/log" in the log too. It is the correct path to the socket file. I am not familiar with the Modsecurity code. Could anybody instruct me to debug this issue? Thanks in advance.