Changing ModSecurity Logging on a Per Transaction Basis

Question

I am trying to trace all requests being made to a website on a shared hosting server. Packet capture is just going to be too cumbersome.

We use Mod Security (2.8) with good effect, although due to the load we only have limited logging enabled

SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"

I don't really want to log everything for the whole server just to inspect what's going on with this one virtual host. I have tried setting

SecAuditEngine On

...inside .htaccess files and it produces a 500 internal error, with the error_log indicating those directives are not allowed in .htaccess, although, in the Modsec documentation the scope of these directives are both shown as "Any"

I have even tried creating a simple SecRule:

SecRule SERVER_NAME "example\.com" "phase:1,ctl:SecAuditEngine=On,id:123456789"

But this creates a syntax error, and it looks like SecAuditEngine or SecAuditLogRelevantStatus cannot be switched dynamically.

Does anyone know if it is possible to modify either of these two directives at transaction time per request?

Answer 1

This can be achieved by using the apache template system to alter the SecAuditEngine directive on a user or domain basis. On a cPanel server this can be achieved by placing *.conf files at the following locations:

/usr/local/apache/conf/userdata/std/2/username/modsec.conf /usr/local/apache/conf/userdata/ssl/2/username/modsec.conf

with contents:

<LocationMatch .*>
    SecAuditEngine On
</LocationMatch>

The "On" setting tells mod security to log transaction data for all response codes (except 404/401 due to a different pathway)