Skip to content

How to disable a ModSecurity rule on a per user basis.

  • Scan for rule hits. 

    awk '
/--[a-zA-Z0-9]+--/ { if (found) print ""; found=0 }
/GET / && !/autodiscover/ { req=$0; found=1 }
/Host:/ { host=$0 }
/X-Forwarded-Host:/ { xfhost=$0 }
/file "/ { rule=$0 }
/id "[0-9]+"/ { match($0, /id "[0-9]+"/); id=substr($0, RSTART, RLENGTH) }
found && req && host && xfhost !~ /autodiscover/ && rule && id {
    print "Request: " req "\n" host "\n" xfhost "\n" rule "\nRule ID: " id "\n---"
    req=""; host=""; xfhost=""; rule=""; id=""
}
' /usr/local/apache/logs/modsec_audit.log | grep "Rule" | sort |uniq -c |sort -nr | head -n 20

  • Top 20 count with awk 

    awk '
/--[a-zA-Z0-9]+--/ { if (found) print ""; found=0 }
/GET / && !/autodiscover/ { req=$0; found=1 }
/Host:/ { host=$0 }
/X-Forwarded-Host:/ { xfhost=$0 }
/file "/ { rule=$0 }
/id "[0-9]+"/ { match($0, /id "[0-9]+"/); id=substr($0, RSTART, RLENGTH) }
found && req && host && xfhost !~ /autodiscover/ && rule && id {
    print "Request: " req "\n" host "\n" xfhost "\n" rule "\nRule ID: " id "\n---"
    req=""; host=""; xfhost=""; rule=""; id=""
}
' /usr/local/apache/logs/modsec_audit.log