如何通过ModSecurity的SecRule设置POST请求体小于10字节时不记录日志？

Got it, let's walk through how to set up both of these ModSecurity logging filters exactly as you need. I'll break each scenario down with clear rules and explanations so you can drop them straight into your config.

1. Skip logging for requests with request bodies exceeding a specified size #

To filter out logs for requests where the body is larger than your threshold (we'll use 1000 bytes as an example—adjust this number to fit your needs), we'll use ModSecurity's REQUEST_BODY_LENGTH variable paired with the ctl:auditLog=Off directive to disable auditing for matching requests.

Add this rule to your ModSecurity configuration file:

SecRule REQUEST_BODY_LENGTH "@gt 1000" "phase:2,nolog,pass,ctl:auditLog=Off,msg:'Skip logging for large request bodies'"

Here's what each parameter does:

• phase:2: Runs the rule after the request body is parsed, ensuring REQUEST_BODY_LENGTH has an accurate value.
• nolog: Prevents this rule itself from being logged in ModSecurity's rule logs (keeps your logs clean).
• pass: Lets the request continue processing without blocking it—we're only filtering logs here, not traffic.
• ctl:auditLog=Off: Disables full audit logging for the matching request.
• msg: An optional descriptive message to help you identify this rule's purpose during debugging.

If you want to keep most log details but omit just the request body (instead of skipping the entire log), replace ctl:auditLog=Off with ctl:auditLogParts=-E (the E part in audit logs corresponds to the request body).

2. Filter unnecessary logs for POST requests with bodies smaller than 10 bytes #

For this scenario, we need to combine two conditions: the request method is POST, and the body length is less than 10 bytes. We'll use a chained rule to link these checks together.

Add this rule to your config:

SecRule REQUEST_METHOD "@streq POST" "phase:2,nolog,pass,chain,msg:'Skip logging for small POST request bodies'"
    SecRule REQUEST_BODY_LENGTH "@lt 10" "ctl:auditLog=Off"

Key details here:

• chain: Tells ModSecurity to only evaluate the second rule if the first one matches (i.e., only check body length for POST requests).
• REQUEST_BODY_LENGTH "@lt 10": Targets POST bodies that are under 10 bytes.
• Again, use ctl:auditLogParts=-E instead of ctl:auditLog=Off if you want to retain other log sections but exclude the small request body.

Quick notes to keep in mind #

• Place these rules in your custom ModSecurity rules section (after base configs but before any strict blocking rules) to ensure they run at the right time.
• Adjust the byte thresholds to match your actual traffic patterns—if you have legitimate small POST requests (like simple API calls), you might need to tweak the 10-byte limit or add exceptions for specific paths.
• Test with curl to verify:

  # Test small POST (should be filtered)
  curl -X POST -d "short" http://your-domain.com/test-endpoint
  # Test large POST (should be filtered if using the 1000-byte rule)
  curl -X POST -d "$(head -c 1200 /dev/zero | tr '\0' 'a')" http://your-domain.com/test-endpoint
  

内容的提问来源于stack exchange，提问作者Pandit