I installed mod_security2 on several dozen servers (each with several dozen VHosts) and don't have the time to configure it for every VHost. In the default configuration, it produces copious amounts of false positives in log files, so I chose to let it run in
DetectionOnly-mode (it doesn't block anything, but I still get detailed logs for most hacking attempts) for all but a select few VHosts.
I was happy with this setup until I discovered that log files on some servers grew to several Gigabytes in less than 3 weeks. I decided to switch off logging for the handful of VHosts that produced the lion's share of those log entries. There are several different ways to do this, I eventually settled on making new rules with very specific triggers that all have
"nolog,phase:1,t:none,ctl:secAuditEngine=Off" as action. This succeeds insofar as the amount of entries in the audit log is reduced to manageable levels.
But I still get Gigabytes of logs because I can't seem to prevent mod_security2 from writing to the error log. I tried
SecDebugLogLevel 0 since it's the only configuration directive concerned with error logging (that I was able to find, anyway), but to no avail. The only thing that seems to help is
SecRuleEngine Off, which defeats the purpose of installing mod_security2 in the first place.
Am I missing something? No matter what I try, it appears as if I can only control the amount of logging to the audit log, while having no control over the amount of logging to the error log.