ModSecurity3问题：Apache error_log缺失Access denied记录求助

使用ModSecurity 3时，Apache的error_log中未记录modsec_audit.log里存在的"ModSecurity: Access denied"记录；切换到ModSecurity 2时，无需修改任何配置，error_log就能正常显示这条Access denied记录。

相关日志及配置 #

modsec_audit.log #

ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `1.2.3.4' ) [file "/etc/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "694"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "1.2.3.4"] [severity "4"] [ver "OWASP_CRS/4.11.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "removed.com"] [uri "/"] [unique_id "174277361972.139763"] [ref "o0,12o0,12v49,12"]
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:foo' (Value: `/etc/passwd' ) [file "/etc/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "97"] [id "930120"] [rev ""] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:foo: /etc/passwd"] [severity "2"] [ver "OWASP_CRS/4.11.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "removed.com"] [uri "/"] [unique_id "174277361972.139763"] [ref "o1,10v10,11t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"]
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:bar' (Value: `/bin/sh' ) [file "/etc/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "596"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/sh found within ARGS:bar: /bin/sh"] [severity "2"] [ver "OWASP_CRS/4.11.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "removed.com"] [uri "/"] [unique_id "174277361972.139763"] [ref "o1,10v10,11t:cmdLine,t:normalizePatho1,6v26,7t:cmdLine,t:normalizePath"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `18' ) [file "/etc/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 18)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.11.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "removed.com"] [uri "/"] [unique_id "174277361972.139763"] [ref ""]

Apache error_log #

[Mon Mar 24 10:46:59.523585 2025] [:error] [pid 600957:tid 601054] [client X.X.X.X:61522] ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `1.2.3.4' ) [file "/etc/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "694"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "1.2.3.4"] [severity "4"] [ver "OWASP_CRS/4.11.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "removed.com"] [uri "/"] [unique_id "174277361972.139763"] [ref "o0,12o0,12v49,12"]
[Mon Mar 24 10:46:59.524888 2025] [:error] [pid 600957:tid 601054] [client X.X.X.X:61522] ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:foo' (Value: `/etc/passwd' ) [file "/etc/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "97"] [id "930120"] [rev ""] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:foo: /etc/passwd"] [severity "2"] [ver "OWASP_CRS/4.11.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "removed.com"] [uri "/"] [unique_id "174277361972.139763"] [ref "o1,10v10,11t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"]
[Mon Mar 24 10:46:59.525165 2025] [:error] [pid 600957:tid 601054] [client X.X.X.X:61522] ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:bar' (Value: `/bin/sh' ) [file "/etc/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "596"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/sh found within ARGS:bar: /bin/sh"] [severity "2"] [ver "OWASP_CRS/4.11.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "removed.com"] [uri "/"] [unique_id "174277361972.139763"] [ref "o1,10v10,11t:cmdLine,t:normalizePatho1,6v26,7t:cmdLine,t:normalizePath"]

规则集 #

OWASP coreruleset-4.11.0-minimal

crs-setup.conf #

SecDefaultAction "phase:1,log,auditlog,pass"
SecDefaultAction "phase:2,log,auditlog,pass"

# -- [[ Paranoia Level Initialization ]] ---------------------------------------
SecAction \
    "id:900000,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/4.11.0',\
    setvar:tx.blocking_paranoia_level=1"

# -- [[ End of setup ]] --------------------------------------------------------
SecAction \
    "id:900990,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/4.11.0',\
    setvar:tx.crs_setup_version=4110"

1. ModSecurity版本日志逻辑差异
   ModSecurity 3调整了动作的日志继承规则：当规则触发deny/block类阻塞动作时，不会自动继承SecDefaultAction中的log动作到Apache的error_log；而ModSecurity 2会自动将阻塞事件同步输出到error_log，这是核心差异点。

2. 阻塞规则未显式指定log动作
   触发阻塞的949110规则（来自REQUEST-949-BLOCKING-EVALUATION.conf）仅包含阻塞相关指令（如deny,status:403），未显式添加log动作。在ModSecurity 3中，只有规则动作里明确写了log，才会将事件输出到error_log；auditlog是独立的日志流，所以这条阻塞记录只会出现在modsec_audit.log中。

3. CRS规则集版本适配
   你使用的OWASP CRS 4.11.0是针对ModSecurity 3优化的版本，默认规则中阻塞动作不再强制同步到error_log，而适配ModSecurity 2的旧版CRS规则会默认包含该同步逻辑。

内容的提问来源于stack exchange，提问作者user2130499