How to configure audit logs #776
Replies: 1 comment
-
Hi @DavidToffs, I saw that you closed the discussion, did you manage to make it work as you were expecting? |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hello everyone, I am currently studying Coraza and found a shortage of log information while configuring audit logs. Here is the content of my configuration
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:(5|4)(0|1)[0-9])$"
SecAuditLogFormat JSON
SecAuditLogType Serial
SecAuditLogParts ABIJDEFHZ
SecAuditLog /Users/david/audit.log
log
{"transaction":{"timestamp":"2023/04/14 10:19:57","unix_timestamp":1681438797806671000,"id":"uRguwgKsnFecZNhvJPA","client_ip":"[::1]","client_port":59964,"host_ip":"","host_port":0,"server_id":"localhost:8090","request":{" method":"","protocol":"","uri":"","http_version":"","headers":{"accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7"],"accept-encoding":["gzip, deflate, br"],"accept-language":["zh-CN,zh;q=0.9"],"cache-control":["max-age=0"],"connection":["keep-alive"],"cookie":["Idea-ab3afc1e=ff9ec3e7-a679-4d1e-83dd-21bcae1aa353; lang=en-US"],"host":["localhost:8090"],"sec-ch-ua":[""Chromium";v="112", "Google Chrome";v="112", "Not:A-Brand";v="99""],"sec-ch-ua-mobile":["?0"],"sec-ch-ua-platform":[""macOS""],"sec-fetch-dest":["document"],"sec-fetch-mode":["navigate"],"sec-fetch-site":["none"],"sec-fetch-user":["?1"],"upgrade-insecure-requests":["1"],"user-agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"]},"body":"","files":null},"response":{"protocol":"","status":0,"headers":{},"body":""},"producer":{"connector":"","version":"","server":"","rule_engine":"On","stopwatch":"1681438797806671000 499000; combined=350000, p1=338000, p2=0, p3=0, p4=0, p5=12000","rulesets":null}}}
For example, the method and uri in the log are empty,Do not know why?
Hope for help, thank you
Beta Was this translation helpful? Give feedback.
All reactions