Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When using mod_security (installed from EPEL) with apache 2 on a centos box, sometimes users are unable to send messages - im having trouble tracing the rule back, the only place i get to is 'inbound anomaly score too high'

anyone know what i should be looking for, how to trace mod_security stuff, or better yet specifically what OWA in 2003 is doing that it doesnt like?

share|improve this question

Did you take a look at Apache error log? If you did, you will see the rule which spawned that message, something like this:

[Mon Dec 13 10:44:16 2010] [error] [client] ModSecurity: Warning. Operator GE matched 20 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/base_rules/modsecurity_crs_60_correlation.conf"] [line "35"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20, SQLi=, XSS=): Request Missing an Accept Header"] [hostname "xx"] [uri "/index.html"] [unique_id "hKt1A38AAAEAADzVdd4AAAAH"]

share|improve this answer

I've heard from a working colleague that it's pretty hard to secure OWA with mod_security.

But you could enable the debug logging of mod_security:

SecDebugLog /usr/local/apache/logs/modsec-debug.log
SecDebugLogLevel 4
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.