iv
Fedora Core, CentOS, and Red Hat Enterprise Linux ......................... 27
Debian and Ubuntu ........................................................................ 27
Installation on Windows ......................................................................... 28
3. Configuration ............................................................................................. 29
Folder Locations ..................................................................................... 30
Configuration Layout .............................................................................. 32
Adding ModSecurity to Apache ............................................................... 33
Powering Up .......................................................................................... 34
Request Body Handling .......................................................................... 35
Response Body Handling ........................................................................ 36
Filesystem Locations ............................................................................... 38
File Uploads ........................................................................................... 38
Debug Log ............................................................................................. 39
Audit Log ............................................................................................... 39
Miscellaneous Options ............................................................................ 40
Default Rule Match Policy ....................................................................... 40
Handling Parsing Errors .......................................................................... 41
Verifying Installation .............................................................................. 42
4. Logging ...................................................................................................... 44
Debug Log ............................................................................................. 44
Debugging in Production ................................................................ 45
Audit Log ............................................................................................... 47
Audit Log Entry Example ................................................................ 48
Concurrent Audit Log ..................................................................... 50
Remote Logging ..................................................................................... 51
Configuring Mlogc ......................................................................... 53
Activating Mlogc ............................................................................ 54
Troubleshooting Mlogc ................................................................... 56
File Upload Interception ......................................................................... 57
Storing Files ................................................................................... 58
Inspecting Files .............................................................................. 58
Integrating with ClamAV ................................................................ 60
Guardian Log ......................................................................................... 61
Advanced Logging Configuration ............................................................ 62
Increasing Logging from a Rule ....................................................... 62
Dynamically Altering Logging Configuration .................................... 63
Removing Sensitive Data from Audit Logs ........................................ 63
Selective Audit Logging ................................................................... 64
5. Rule Language Overview ............................................................................. 66
