How do I print coraza's logs if I want to test with ftw

[Axkea]

I'm currently building a plugin using coraza, and I need to use go-ftw to test whether the rule set works. Can you provide some examples of how I should filter the logs?

[dextermallo]

Hi @Axkea, what do you mean by filtering the logs? Do you mean you want to perform some actions after recording a log or do you what to know whether a rule is working against test cases from go-ftw?

[Axkea]

This is how I set up the log now, but sometimes it doesn't have any output

[dextermallo]

I think the easiest way is to:

1. Start Coraza with CRS rules (e.g., https://github.com/corazawaf/coraza/tree/main/examples/http-server)

// clone the rules folder from CRS and modify the Directives
waf, err := coraza.NewWAF(
		coraza.NewWAFConfig().
			WithErrorCallback(logError).
			WithDirectivesFromFile("./coreruleset/rules/*.conf").
			WithDirectivesFromFile("./coraza.conf"),
	)

2. Run the go-ftw, like go-ftw run -d <Your_CRS_Folder/tests/regression/tests>

In this way, you can have both coraza log and go-ftw in stdout, and you can also store it as a file if you wish

[Axkea]

I try to print this error log to a file but sometimes it doesn't work

[Axkea]

https://github.com/Axkea/envoy-go-waf/tree/main/ftw

[Axkea]

https://github.com/Axkea/envoy-go-waf/blob/main/plugin/parse.go#L117

[jcchavezs]

You can use this as inspiration https://github.com/corazawaf/coraza-proxy-wasm/blob/main/ftw/docker-compose.yml

…

On Thu, 27 Jul 2023, 19:57 Achilles, ***@***.***> wrote: https://github.com/Axkea/envoy-go-waf/blob/main/plugin/parse.go#L117 — Reply to this email directly, view it on GitHub <#853 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAX5XYR5L5DBQ4ZGJ4DXSKTZ5ANCNFSM6AAAAAA22H34EU> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Axkea]

I use this as a reference, but I need to know when the log is printed

[Axkea]

Because I need to output coraza's logs to a file, I can't set the log printer for coraza directly

[Axkea]

When I went to output coraza's log to a file, it worked under normal conditions, but it had no output when I ran the go-ftw test