{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/840","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/840/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/840/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/840/events","html_url":"https://github.com/SpiderLabs/ModSecurity/pull/840","id":57802732,"number":840,"title":"Fix apache logging limitation by using correct apache call.","user":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/labels/release-2.9.1","name":"release-2.9.1","color":"5319e7"}],"state":"closed","locked":false,"assignee":{"login":"zimmerle","id":428268,"avatar_url":"https://avatars.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"milestone":null,"comments":24,"created_at":"2015-02-16T13:13:40Z","updated_at":"2016-03-08T13:46:10Z","closed_at":"2015-12-10T15:33:05Z","pull_request":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/pulls/840","html_url":"https://github.com/SpiderLabs/ModSecurity/pull/840","diff_url":"https://github.com/SpiderLabs/ModSecurity/pull/840.diff","patch_url":"https://github.com/SpiderLabs/ModSecurity/pull/840.patch"},"body":"Apache 2.4 brought the option to change the ErrorLogFormat. However, many\r\nfields remain empty, as ModSecurity uses the wrong apache logging function.\r\nThis fixes this behaviour with the use of ap_log_rerror."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/193791027","html_url":"https://github.com/SpiderLabs/ModSecurity/pull/840#issuecomment-193791027","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/840","id":193791027,"user":{"login":"bazzadp","id":10931297,"avatar_url":"https://avatars.githubusercontent.com/u/10931297?v=3","gravatar_id":"","url":"https://api.github.com/users/bazzadp","html_url":"https://github.com/bazzadp","followers_url":"https://api.github.com/users/bazzadp/followers","following_url":"https://api.github.com/users/bazzadp/following{/other_user}","gists_url":"https://api.github.com/users/bazzadp/gists{/gist_id}","starred_url":"https://api.github.com/users/bazzadp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bazzadp/subscriptions","organizations_url":"https://api.github.com/users/bazzadp/orgs","repos_url":"https://api.github.com/users/bazzadp/repos","events_url":"https://api.github.com/users/bazzadp/events{/privacy}","received_events_url":"https://api.github.com/users/bazzadp/received_events","type":"User","site_admin":false},"created_at":"2016-03-08T13:46:10Z","updated_at":"2016-03-08T13:46:10Z","body":"AFAIK it was always there for the other modules - just not for ModSecurity, but that's not what @MichaelHaas is raising. There is one extra line now for the ModSecurity error in the audit log.\r\n\r\nSo, prior to 2.9.1-RC1 it used to say:\r\n\r\n```\r\nApache-Error: [file \"mod_authz_core.c\"] [line 809] [level 7] AH01626: authorization result of %s: %s\r\nApache-Error: [file \"mod_authz_core.c\"] [line 809] [level 7] AH01626: authorization result of %s: %s\r\nApache-Error: [file \"mod_authz_core.c\"] [line 809] [level 7] AH01626: authorization result of %s: %s\r\nApache-Error: [file \"core.c\"] [line 4433] [level 6] AH00128: File does not exist: %s\r\n```\r\n\r\nwith the %s not being filled in.\r\n\r\nand now it says:\r\n\r\n```\r\nApache-Error: [file \"mod_authz_core.c\"] [line 809] [level 7] AH01626: authorization result of %s: %s\r\nApache-Error: [file \"mod_authz_core.c\"] [line 809] [level 7] AH01626: authorization result of %s: %s\r\nApache-Error: [file \"mod_authz_core.c\"] [line 809] [level 7] AH01626: authorization result of %s: %s\r\nApache-Error: [file \"core.c\"] [line 4433] [level 6] AH00128: File does not exist: %s\r\nApache-Error: [file \"apache2_util.c\"] [line 271] [level 3] [client %s] ModSecurity: %s%s [uri \"%s\"]%s\r\n```\r\n\r\nwith the %s not being filled in **and** an extra line for ModSecurity now, since it is now going through the proper apache error logging thanks to this change.\r\n\r\nTo me if you're dealing with the other messages already then one extra message for ModSecurity is not a big deal. But that's just me, because I never noticed them or used them before (and hence didn't even see what @MichaelHaas was talking about initially!). And because I want this change for other reasons :-)"}}