Created
April 24, 2017 20:03
-
-
Save zimmerle/bef703e5f57c42d5d958fe20a59e8971 to your computer and use it in GitHub Desktop.
Logs for an empty JSON
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Initialising transaction (txid AAAAAH8AAAEAAEU@q0wAAAAC). | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transaction context created (dcfg 1b224f8). | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Starting phase REQUEST_HEADERS. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1be06f8; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "23"] [id "200000"]. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1be06f8: SecRule "REQUEST_HEADERS:Content-Type" "@rx (?:application(?:/soap\\+|/)|text/)xml" "phase:1,auditlog,id:200000,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML" | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 2 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "rx" with param "(?:application(?:/soap\\+|/)|text/)xml" against REQUEST_HEADERS:Content-Type. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 13 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1be2458; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "30"] [id "200001"]. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1be2458: SecRule "REQUEST_HEADERS:Content-Type" "@rx application/json" "phase:1,auditlog,id:200001,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON" | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "rx" with param "application/json" against REQUEST_HEADERS:Content-Type. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 1 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Ctl: Set requestBodyProcessor to JSON. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Warning. Pattern match "application/json" at REQUEST_HEADERS:Content-Type. [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "30"] [id "200001"] | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 1. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Second phase starting (dcfg 1b224f8). | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Reading request body. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] JSON parser initialization | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][2] JSON parser error: parse error: premature EOF | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Completed receiving request body (length 0). | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Starting phase REQUEST_BODY. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1b4db48; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "60"] [id "200002"]. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1b4db48: SecRule "REQBODY_ERROR" "!@eq 0" "phase:2,auditlog,id:200002,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:%{reqbody_error_msg},severity:2" | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "!eq" with param "0" against REQBODY_ERROR. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 1 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][2] Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "60"] [id "200002"] [msg "Failed to parse request body."] [data "JSON parser error: parse error: premature EOF\x0a"] [severity "CRITICAL"] | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 1. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1c029f0; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "81"] [id "200003"]. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1c029f0: SecRule "MULTIPART_STRICT_ERROR" "!@eq 0" "phase:2,auditlog,id:200003,t:none,log,deny,status:400,msg:'Multipart request body failed strict validation: PE %{REQBODY_PROCESSOR_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_MISSING_SEMICOLON}, IQ %{MULTIPART_INVALID_QUOTING}, IP %{MULTIPART_INVALID_PART}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'" | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "!eq" with param "0" against MULTIPART_STRICT_ERROR. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 0 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1c05848; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "86"] [id "200004"]. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1c05848: SecRule "MULTIPART_UNMATCHED_BOUNDARY" "!@eq 0" "phase:2,auditlog,id:200004,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'" | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "!eq" with param "0" against MULTIPART_UNMATCHED_BOUNDARY. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 1 usec. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1c06fb0; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "100"] [id "200005"]. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1c06fb0: SecRule "TX:/^MSC_/" "!@streq 0" "phase:2,log,auditlog,id:200005,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'" | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Hook insert_filter: Adding input forwarding filter (r 1d6dfc0). | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Hook insert_filter: Adding output filter (r 1d6dfc0). | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Forwarding input: mode=0, block=0, nbytes=8192 (f 1d7c6f0, r 1d6dfc0). | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Sent EOS. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Input forwarding complete. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Initialising logging. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] Starting phase LOGGING. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] Recording persistent data took 0 microseconds. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] Audit log: Logging this transaction. | |
| [24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] JSON: Cleaning up JSON results |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment