{"action":"created","issue":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/447","repository_url":"https://api.github.com/repos/nbs-system/naxsi","labels_url":"https://api.github.com/repos/nbs-system/naxsi/issues/447/labels{/name}","comments_url":"https://api.github.com/repos/nbs-system/naxsi/issues/447/comments","events_url":"https://api.github.com/repos/nbs-system/naxsi/issues/447/events","html_url":"https://github.com/nbs-system/naxsi/issues/447","id":379674714,"node_id":"MDU6SXNzdWUzNzk2NzQ3MTQ=","number":447,"title":"When naxsi.rule sets up log policy，Return 504 error","user":{"login":"loki008","id":42764998,"node_id":"MDQ6VXNlcjQyNzY0OTk4","avatar_url":"https://avatars1.githubusercontent.com/u/42764998?v=4","gravatar_id":"","url":"https://api.github.com/users/loki008","html_url":"https://github.com/loki008","followers_url":"https://api.github.com/users/loki008/followers","following_url":"https://api.github.com/users/loki008/following{/other_user}","gists_url":"https://api.github.com/users/loki008/gists{/gist_id}","starred_url":"https://api.github.com/users/loki008/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loki008/subscriptions","organizations_url":"https://api.github.com/users/loki008/orgs","repos_url":"https://api.github.com/users/loki008/repos","events_url":"https://api.github.com/users/loki008/events{/privacy}","received_events_url":"https://api.github.com/users/loki008/received_events","type":"User","site_admin":false},"labels":[{"id":460892002,"node_id":"MDU6TGFiZWw0NjA4OTIwMDI=","url":"https://api.github.com/repos/nbs-system/naxsi/labels/question","name":"question","color":"1d76db","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-11-12T08:47:41Z","updated_at":"2018-11-26T04:04:01Z","closed_at":null,"author_association":"NONE","body":"When naxsi.rule sets up log policy，After rule matching，Return 504 error，And there is no log record.\r\nWhen naxsi.rule sets up block policy，it's OK，it can block and record log.\r\nwhy？Please help，thanks.\r\n\r\nnginx.conf information：\r\n\r\n```nginx\r\nuser admin admin;\r\n\r\nworker_processes auto;\r\nworker_cpu_affinity auto;\r\n\r\nerror_log /data/logs/nginx/error.log crit;\r\npid /var/run/nginx.pid;\r\n\r\nworker_rlimit_nofile 65535;\r\n\r\ninclude dso_conf/ngx_dso_modules.conf;\r\n\r\nevents {\r\n    use epoll;\r\n    worker_connections 10240;\r\n}\r\n\r\nhttp {\r\n    include naxsi_core.rules;\r\n    server_tokens off;\r\n    server_tag off;\r\n    autoindex off;\r\n    access_log off;\r\n    include mime.types;\r\n    default_type application/octet-stream;\r\n\r\n    server_names_hash_bucket_size 128;\r\n    client_header_buffer_size 128k;\r\n    large_client_header_buffers 4 128k;\r\n    client_max_body_size 2m;\r\n    client_body_buffer_size 256k;\r\n\r\n    sendfile on;\r\n    tcp_nopush on;\r\n    keepalive_timeout 900;\r\n    tcp_nodelay on;\r\n\r\n    gzip on;\r\n    gzip_min_length 1k;\r\n    gzip_buffers 4 16k;\r\n    gzip_http_version 1.1;\r\n    gzip_comp_level 6;\r\n    gzip_types \"image/jpeg;charset=utf-8\" text/plain application/x-javascript text/css application/xml application/javascript text/javascript image/jpeg image/gif image/png;\r\n    gzip_vary on;\r\n\r\n    proxy_connect_timeout 900;\r\n    proxy_read_timeout 900;\r\n    proxy_send_timeout 900;\r\n    proxy_buffer_size 128k;\r\n    proxy_buffers 4 128k;\r\n    proxy_busy_buffers_size 256k;\r\n    proxy_temp_file_write_size 256k;\r\n    proxy_headers_hash_max_size 1024;\r\n    proxy_headers_hash_bucket_size 128;\r\n\r\n    proxy_redirect off;\r\n    proxy_set_header Host $host;\r\n    proxy_set_header X-Real-IP $remote_addr;\r\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n    proxy_cache_path /data/logs/nginx/cache1 levels=1:2 keys_zone=cache1:100m max_size=50g inactive=90d;\r\n    proxy_temp_path /data/logs/nginx/nginx_temp/nginx_temp;\r\n\r\n    log_format access '$remote_addr - $remote_user [$time_local] \"$request\"'\r\n                      '$status $body_bytes_sent \"$http_referer\"'\r\n                      '\"$http_user_agent\" $http_x_forwarded_for';\r\n\r\n    log_format ha     '$remote_addr\\t$time_local\\t$host\\t\"$request\"\\t'\r\n                      '$status\\t$body_bytes_sent\\t\"$http_referer\"\\t'\r\n                      '\"$http_user_agent\"\\t$request_time\\t$sent_http_content_type\\t'\r\n                      '$upstream_addr\\t$upstream_status\\t$upstream_response_time\\t'\r\n                      '\"$http_x_forwarded_for\"';\r\n\r\n    log_format main '$remote_addr\\t$time_local\\t\"$request\"\\t'\r\n                '$status\\t$body_bytes_sent\\t\"$http_referer\"\\t'\r\n                '\"$http_user_agent\"\\t$request_time\\t'\r\n                '$upstream_addr\\t$upstream_status\\t$upstream_response_time\\t'\r\n                '\"$http_x_forwarded_for\"\\t$host';\r\n\r\n    log_format json '$remote_addr\\t-\\t$remote_user\\t[$time_local]\\t\"$request\"\\t'\r\n                      '$status $body_bytes_sent\\t\"$http_referer\"\\t'\r\n                      '\"$http_user_agent\"\\t$request_time\\t'\r\n                      '$http_x_requested_with\\t$sent_http_content_type\\t'\r\n                      '$host\\t$upstream_response_time';\r\n\r\n\r\n\r\n    map $http_x_forwarded_proto $https_status {\r\n        default off;\r\n        https on;\r\n    }\r\n    map $http_upgrade $connection_upgrade {\r\n        default upgrade;\r\n        ''      close;\r\n    }\r\n\r\n    ## reqstat\r\n    req_status_zone server_reqstat_monitor \"$host\" 100M;\r\n\r\n\r\n   ##\r\n    # limit req zone\r\n    ##\r\n    limit_req_zone $binary_remote_addr $http_user_agent zone=limit_with_user_agent:50m rate=30r/m;\r\n    limit_req_zone $binary_remote_addr $uri zone=limit_with_uri:50m rate=3r/m;\r\n    limit_req_zone $server_name zone=limit_server_qps:10m rate=3500r/s;\r\n    limit_req_zone $binary_remote_addr zone=limit_with_remote_addr:20m rate=5r/m;\r\n\r\n    include conf.d/*.conf;\r\n    include upstream/*.conf;\r\n    include vhost.d/*.conf;\r\n}\r\n\r\nvhost.d/conf information：\r\nserver {\r\n\r\n  listen   80;\r\n  server_name 10.10.10.10 test.fc.17.com;\r\n\r\n  access_log  /data/logs/nginx/test.fc.17.com_access.log main;\r\n  error_log   /data/logs/nginx/test.fc.17.com_error.log;\r\n\r\n  root /home/admin/app-run/fc.17.com/dist;\r\n#  include /opt/app/nginx/conf/web.spa.node.conf;\r\n  include /opt/app/nginx/conf/global.conf;\r\n\r\n\r\ngzip on;\r\ngzip_min_length 1k;\r\ngzip_comp_level 2;\r\n\r\nlocation / {\r\n    include /opt/app/nginx/conf/naxsi.rules;\r\n#    include /opt/app/nginx/conf/naxsi_BasicRule.conf;\r\n    try_files $uri $uri/ /index.html;\r\n}\r\nlocation ~* \\.(html)$ {\r\n    expires -1;\r\n}\r\nlocation ~* \\.(js|css|png|jpg|jpeg|gif|ico|icon|bmp|swf)$ {\r\n    expires 1y;\r\n}\r\nlocation  /p/ {\r\n    include /opt/app/nginx/conf/naxsi.rules; \r\n    proxy_pass http://test.node.17.com;\r\n    #proxy_set_header X-Forwarded-For  $remote_addr;\r\n    proxy_set_header Host test.node.17.com;\r\n}\r\nlocation /RequestDenied {       \r\n    return 403;\r\n}\r\n\r\nerror_page  403  /403.html;\r\nlocation = /403.html {\r\n    root   html;\r\n}\r\n\r\nerror_page   500 502 503 504  /50x.html;\r\nlocation = /50x.html {\r\n    root   html;\r\n}\r\n}\r\n```\r\n\r\nnaxsi.rule information：\r\n```\r\nSecRulesEnabled;\r\nDeniedUrl \"/RequestDenied\";\r\nCheckRule \"$SQL >= 8\" BLOCK;\r\nCheckRule \"$RFI >= 8\" LOG;\r\nCheckRule \"$TRAVERSAL >= 8\" LOG;\r\nCheckRule \"$EVADE >= 8\" LOG;\r\nCheckRule \"$XSS >= 8\" LOG;\r\nCheckRule \"$CMD >= 8\" BLOCK;\r\nCheckRule \"$INCLUSION >= 8\" LOG;\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/comments/441513009","html_url":"https://github.com/nbs-system/naxsi/issues/447#issuecomment-441513009","issue_url":"https://api.github.com/repos/nbs-system/naxsi/issues/447","id":441513009,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTUxMzAwOQ==","user":{"login":"loki008","id":42764998,"node_id":"MDQ6VXNlcjQyNzY0OTk4","avatar_url":"https://avatars1.githubusercontent.com/u/42764998?v=4","gravatar_id":"","url":"https://api.github.com/users/loki008","html_url":"https://github.com/loki008","followers_url":"https://api.github.com/users/loki008/followers","following_url":"https://api.github.com/users/loki008/following{/other_user}","gists_url":"https://api.github.com/users/loki008/gists{/gist_id}","starred_url":"https://api.github.com/users/loki008/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loki008/subscriptions","organizations_url":"https://api.github.com/users/loki008/orgs","repos_url":"https://api.github.com/users/loki008/repos","events_url":"https://api.github.com/users/loki008/events{/privacy}","received_events_url":"https://api.github.com/users/loki008/received_events","type":"User","site_admin":false},"created_at":"2018-11-26T04:04:01Z","updated_at":"2018-11-26T04:04:01Z","author_association":"NONE","body":"2018/11/26 11:12:52 [error] 10703#0: *88231 NAXSI_FMT: ip=172.29.28.205&server=test.fc.17shihui.com&uri=/p/bankroll/v2/accounts/apply&learning=0&vers=0.56&total_processed=22&total_blocked=3&block=1&zone0=BODY&id0=20&var_name0=, client: 172.29.28.205, server: 10.120.180.54, request: \"POST /p/bankroll/v2/accounts/apply HTTP/1.1\", host: \"test.fc.17shihui.com\", referrer: \"http://test.fc.17shihui.com/bankrollAccount/apply\"\r\n\r\nwhat is id0=20？"}}
{"actor":{"display_login":"loki008"}}