Issue ModSecurity Atomicorp not logging to modsec_audit.log

[Jonathan B]

Server operating system version

AlmaLinux 8.10

Plesk version and microupdate number

Plesk Obsidian 18.0.70. #2

Hi guys, i have Plesk installed on AlmaLinux 8.10 (Cerulean Leopard) with Plesk Obsidian 18.0.70.

For some days now, ModSecurity (Atomicorp) has not been logging events for some domains to the modsec_audit.log file.
However, the WAF is working correctly, as its actions are clearly shown in the error_log files of the individual websites.

Is anyone else experiencing this problem?

 

[Sebahat.hadzhi]

Hello, @Jonathan B . Is ModSecurity in detection only mode by any chance?

 

[Jonathan B]

Thank you but no, it is active.
In the website's error logs, ModSecurity logs with 403 errors returned to the client are present.

For example: ModSecurity: [file "/etc/httpd/conf/modsecurity.d/rules/tortix/modsec/20_asl_useragents.conf"] [line "187"] [id "332039"] [rev "4"] [msg "Atomicorp.com WAF Rules: Suspicious Unusual User Agent (python-requests). Disable this rule if you use python-requests/. "] [severity "CRITICAL"] Access denied with code 403 (phase 2). Pattern match "python-requests/" at REQUEST_HEADERS:user-agent. [hostname "www.xxx.it"] [uri "/"] [unique_id "aGywK5m3yJdd8tXr1OmVmAAAAII"]

The issue is only present in the main log (modsec_audit.log), which remains empty.

A few days ago there was an update error of the modsecurity rules update, then since it disappeared, this problem started.

 

[Sebahat.hadzhi]

Thank you for the confirmation. Could you please try executing the following commands:

/usr/local/psa/admin/bin/modsecurity_ctl -d
/usr/local/psa/admin/bin/modsecurity_ctl -e

This action should recrate the ModSecurity configuration and, hopefully, sort the entry logging issue.

 

[Jonathan B]

Thank you very much, but this operation didn't solve the problem. I still see the error log, but not the detailed logs in modsec_audit.log.

By any chance, do you know which configuration file contains the directives for writing to the modsec_audit.log file?

 

[Sebahat.hadzhi]

Hey, @Jonathan B . That should be defined in /etc/httpd/conf/plesk.conf.d/server.conf:

cat /etc/httpd/conf/plesk.conf.d/server.conf | grep SecAuditLog

 

[Jonathan B]

Thank you very much, but searching for SecAuditLog also led to nothing, everything looks okay, and there are no directives with "off".
For now, I will keep the system as it is since the WAF is working correctly, and I hope a future update will resolve it automatically.