Neither audit.log nor debug.log

[Ezizeay]

Dear

Modsecurity does not record any log information.

1. Is it because of "nolog" as below?
   [root@server modsecurity.d]# cat modsecurity.conf

2. by the way, following two config files contain information as follows.
   [root@server modsecurity.d]#cat httpd.conf
   IncludeOptional conf.d/*.conf

[root@server modsecurity.d]#cat /etc/httpd/conf.d/mod_security.conf

Include modsecurity.d/modsecurity.conf
Include modsecurity.d/owasp-modsecurity-crs/crs-setup.conf
Include modsecurity.d/owasp-modsecurity-crs/rules/*.conf

---

Environment
CentOS 7.5.1804 (Core)
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
Apache/2.4.29 (CentOS)

---

What are the possible reasons of having no log at all?

Sincerely

[victorhora]

There's many possibilities. Check your apache error_log to see if you spot any error message. Also ensure that your log files (e.g. SecAuditLog) have the proper permissions your file system for Apache/ModSecurity to write on them.

Also, by default the audit log messages are not generated for harmless requests. An easy way to test is to trigger a potentially malicious request like any XSS or SQLi payload and see if the messages are generated (assuming you have a ruleset loaded like the CRS to detect malicious requests). You can change this behaviour by tuning the SecAuditLogRelevantStatus directive.

Lastly, yes, the nolog action is meant to write no logs to audit_log or error_log. But it's per rule (which means that other rules that doesn't have this action should still generate logs) and you should still see debug messages if you enable the SecDebugLog directive.