Web Application Defender's Cookbook

Recipe 1-6: Enable Full HTTP Audit Logging

This recipe shows you how to capture full HTTP transaction data by using the ModSecurity audit engine.

Ingredients

• ModSecurity Reference Manual14
  • SecRuleEngine directive
  • SecAuditEngine directive
  • SecAuditLog directive
  • SecAuditLogType directive
  • SecAuditLogParts directive
  • SecAuditLogStorageDir directive
  • SecRequestBodyAccess directive
  • SecResponseBodyAccess directive
  • Audit log format documentation15

ENABLING FULL AUDIT LOGGING TO ONE FILE

If you want to provide the greatest amount of data for incident response processes, you should enable full audit logging of both HTTP request and response traffic. Add or update the following ModSecurity directives in your Apache configuration files:

SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess On
SecAuditEngine On
SecAuditLogParts ABCEFHZ
SecAuditLog /usr/local/apache/logs/audit.log
SecAuditLogType Serial

These directives create full audit logs of the HTTP transactions and store data from all clients to one file called /usr/local/apache/logs/audit.log. SecAuditLogParts defines the separate transactional elements that are captured:

• A: Audit log header
• B: Request headers
• C: Request body
• E: Intended response body
• F: Response headers
• H: Audit log trailer
• Z: Audit log footer

Let’s again look at one of the WordPress POST web requests from before, except this time captured by ModSecurity’s audit engine:

--26b60826-A-- [15/Feb/2012:09:08:17 --0500] Tzu8UcCoqAEAAR4rI1cAAAAA ...