{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1073","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1073/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1073/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1073/events","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/1073","id":132816515,"number":1073,"title":"Spurious unformatted 'Apache-Error' audit log lines in 2.9.1RC1","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-02-10T21:01:18Z","updated_at":"2016-06-30T14:44:30Z","closed_at":null,"body":"With ModSecurity 2.9.1RC1 on FreeBSD, for every ModSecurity log line in the audit log, another line `Apache-Error: [file \"apache2_util.c\"] [line 271] [level 3] [client %s] ModSecurity: %s%s [uri \"%s\"]%s` line is logged. (So if there are three ModSecurity events, there are three `Apache-Error` lines)\r\n\r\nThis looks weird and increases the site of the audit logs.\r\n\r\nReproduce:\r\n\r\n- Generate any ModSecurity event\r\n- See in audit log an `Apache-Error` line for every ModSecurity log entry in `H` section\r\n\r\nExample:\r\n\r\n```\r\n-16c05e04-H--\r\nMessage: Warning. Pattern match \"(?i:(?:[\\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]\\\\s*?\\\\*.+(?:x?or|div|like|between|and|id)\\\\W*?[\\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]\\\\d)|(?:\\\\^[\\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98])|(?:^[\\\\w\\\\s\\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98-]+(?<=and\\\\s)(?<=or|xor ...\" at ARGS:id. [file \"/usr/local/etc/apache24/security2/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf\"] [line \"245\"] [id \"981243\"] [msg \"Detects classic SQL injection probings 2/2\"] [data \"Matched Data: '''''''''''''''''''''''''''''''''' found within ARGS:id: ''''''''''''''''''''''''''''''''''\"] [severity \"CRITICAL\"] [tag \"OWASP_CRS/WEB_ATTACK/SQL_INJECTION\"]\r\nMessage: Access denied with code 403 (phase 2). Pattern match \"(.*)\" at TX:981243-Detects classic SQL injection probings 2/2-OWASP_CRS/WEB_ATTACK/SQLI-ARGS:id. [file \"/usr/local/etc/apache24/security2/activated_rules/modsecurity_crs_49_inbound_blocking.conf\"] [line \"26\"] [id \"981176\"] [msg \"Inbound Anomaly Score Exceeded (Total Score: 5, SQLi=1, XSS=0): Last Matched Message: 981243-Detects classic SQL injection probings 2/2\"] [data \"Last Matched Data: ''''''''''''''''''''''''''''''''''\"]\r\nMessage: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file \"/usr/local/etc/apache24/security2/activated_rules/modsecurity_crs_60_correlation.conf\"] [line \"37\"] [id \"981204\"] [msg \"Inbound Anomaly Score Exceeded (Total Inbound Score: 5, SQLi=1, XSS=0): 981243-Detects classic SQL injection probings 2/2\"]\r\nApache-Error: [file \"apache2_util.c\"] [line 271] [level 3] [client %s] ModSecurity: %s%s [uri \"%s\"]%s\r\nApache-Error: [file \"apache2_util.c\"] [line 271] [level 3] [client %s] ModSecurity: %s%s [uri \"%s\"]%s\r\nApache-Error: [file \"apache2_util.c\"] [line 271] [level 3] [client %s] ModSecurity: %s%s [uri \"%s\"]%s\r\nAction: Intercepted (phase 2)\r\nApache-Handler: application/x-httpd-php\r\nStopwatch: 1455137855165863 20183 (- - -)\r\nStopwatch2: 1455137855165863 20183; combined=16486, p1=4190, p2=11871, p3=0, p4=0, p5=423, sr=205, sw=2, l=0, gc=0\r\nProducer: ModSecurity for Apache/2.9.1-RC1 (http://www.modsecurity.org/); OWASP_CRS/2.2.9.\r\nServer: Apache/2.4.18\r\nEngine-Mode: \"ENABLED\"\r\n\r\n--16c05e04-Z--\r\n```"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/229680175","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/1073#issuecomment-229680175","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1073","id":229680175,"user":{"login":"chavez243ca","id":12299994,"avatar_url":"https://avatars.githubusercontent.com/u/12299994?v=3","gravatar_id":"","url":"https://api.github.com/users/chavez243ca","html_url":"https://github.com/chavez243ca","followers_url":"https://api.github.com/users/chavez243ca/followers","following_url":"https://api.github.com/users/chavez243ca/following{/other_user}","gists_url":"https://api.github.com/users/chavez243ca/gists{/gist_id}","starred_url":"https://api.github.com/users/chavez243ca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chavez243ca/subscriptions","organizations_url":"https://api.github.com/users/chavez243ca/orgs","repos_url":"https://api.github.com/users/chavez243ca/repos","events_url":"https://api.github.com/users/chavez243ca/events{/privacy}","received_events_url":"https://api.github.com/users/chavez243ca/received_events","type":"User","site_admin":false},"created_at":"2016-06-30T14:44:30Z","updated_at":"2016-06-30T14:44:30Z","body":"seeing the same here: FreeBSD 9.3-RELEASE-p39 / Apache24 / modsec 2.9.1"}}
{"actor":{"display_login":"chavez243ca"}}