does not record any log in apache

[Ezizeay]

Dear

Modsecurity simply not working.

1. If following permision is problematic, what is right set of permission please?
   

2. SecAuditLog looks OK.
   

3. Apache error log did not give any specific information
   

4. Tested by following codes (no browser).
   curl 'http://localhost/?q="><script>alert(1)</script>'
   curl -L 'https://IP/?q="><script>alert(1)</script>'
   curl "http://IP/?q='1 OR 1=1"
   curl 'http://IP/?union+select'

Modsecurity is embeded well in Apache.
What should I do to get it worked please ?

Environment
CentOS 7.5.1804 (Core)
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
Apache/2.4.29 (CentOS)

[victorhora]

Hi @Ezizeay

You should set your permissions according to your environment. If you run Apache as root those permissions should be fine for Apache to write to the log files. If you don't you need to change your permissions to allow the user that runs Apache to write on these files.

Your Apache error log seems to be configured in a verbose or debug mode. All those messages doesn't seem closely related with ModSecurity.

I suggest that look for your audit_log (modsec_audit.log) and your access_logs to check if those requests are actually hitting your Apache webserver and ModSecurity. It could be a good idea to follow some of the tutorials to see if you are missing something in particular.