Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an apache server which uses mod_security configuration. Those logs are further analyzed and sent out to OSSEC server for intrusion detection and monitoring.

That OSSEC server then sends those logs for normalization and advance correlation to SIEM, the parser at SIEM is able to parse quiet a few mod_sec messages but the one particular type message including in the payload

"rx ^%{tx.allowed_request_content_type}$"

cannot seemed to be parsed at SIEM system, Instead of changing the parse code at SIEM end which may seems impossible because its closed source, I want to know if there is way to change the logging output much like apache custom log features. The full log payload is shown below:-

Sep 13 13:35:37 ossec-server ossec: Alert Level: 7; Rule: 50118 - Access attempt blocked by Mod Security.; Location: (WebServer)>/usr/local/apache2/logs/error_log; [Fri Sep 13 13:37:09.190450 2013] [:error] [pid 2584:tid 140049089795840] [client] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/usr/local/apache2/conf/modsecurity-crs/activated_rules/modsecurity_crs_30_http_policy.conf"] [line "64"] [id "960010"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "application/octet-stream"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.8"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "abc.com"] [uri "/"] [unique_id "UjLOtQoKUakAAAoYEh8AAAAO"]

Can i specify apache not to log the above highlighted text when writing logs?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.