Can someone please help me with setting rules such that i get only the data which is being posted using POST. I have a form where i am submitting name and email id. I want to save just that part to be saved in the log file. In my scenario i just want below data in my log file:-
--29000000-C--
name1=ssn&email1=ssn%40gmail.com
--29000000-F--
HTTP/1.1 200 OK
X-Powered-By: PHP/7.2.4
Content-Length: 16
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
My present mod_security looks like:-
<IfModule security2_module>
#Enable the module.
SecRuleEngine On
SecAuditEngine on
#Setup logging in a dedicated file.
SecAuditLog C:/wamp64/bin/apache/apache2.4.33/logs/website-audit.log
#Allow it to access requests body.
SecRequestBodyAccess on
SecAuditLogParts ABIFHZ
#Setup default action.
SecDefaultAction "nolog,noauditlog,allow,phase:2"
#Define the rule that will log the content of POST requests.
SecRule REQUEST_METHOD "^POST$" "chain,allow,phase:2,id:123"
SecRule REQUEST_URI ".*" "auditlog"
</ifmodule>
I found a solution to my question. We can set below field as per our requirement:-
SecAuditLogParts ABIFHZ
In my case i set the field as:- SecAuditLogParts C
however it will display as:-
--84670000-A--
[29/Aug/2018:14:49:58 +0200] W4aWdqHJuCcOQzTIgCiEqAAAAD8 127.0.0.1 60735 127.0.0.1 80
--84670000-C--
name1=red&email1=red%40yahoo.com
--84670000-Z--