Stuff

[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Initialising transaction (txid TejlTMCoCwoAAEplHgUAAABA).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Transaction context created (dcfg 26d6d30).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] First phase starting (dcfg 26d6d30).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Starting phase REQUEST_HEADERS.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] This phase consists of 3 rule(s).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Recipe: Invoking rule 2580398; [file "/opt/apache2/conf/modsec.2.6/modsecurity.conf"] [line "23"].
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][5] Rule 2580398: SecRule "REQUEST_HEADERS:Content-Type" "@rx text/xml" "phase:1,auditlog,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Rule returned 0.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] No match, not chained -> mode NEXT_RULE.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Recipe: Invoking rule 2589910; [file "/opt/apache2/conf/modsec.2.6/modsecurity_crs_10_config.conf"] [line "295"] [id "981053"].
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][5] Rule 2589910: SecRule "REQUEST_HEADERS:Content-Type" "@rx text/xml" "phase:1,chain,id:981053,t:none,t:lowercase,pass,nolog"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Rule returned 0.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] No match, chained -> mode NEXT_CHAIN.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Second phase starting (dcfg 26d6d30).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Input filter: This request does not have a body.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Starting phase REQUEST_BODY.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] This phase consists of 4 rule(s).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Recipe: Invoking rule 2581130; [file "/opt/apache2/conf/modsec.2.6/modsecurity.conf"] [line "54"].
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][5] Rule 2581130: SecRule "REQBODY_ERROR" "!@eq 0" "phase:2,auditlog,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:%{reqbody_error_msg},severity:2"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Transformation completed in 2 usec.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Executing operator "!eq" with param "0" against REQBODY_ERROR.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] Target value: "0"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Operator completed in 4 usec.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Rule returned 0.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] No match, not chained -> mode NEXT_RULE.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Recipe: Invoking rule 2581fa8; [file "/opt/apache2/conf/modsec.2.6/modsecurity.conf"] [line "74"].
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][5] Rule 2581fa8: SecRule "MULTIPART_STRICT_ERROR" "!@eq 0" "phase:2,auditlog,t:none,log,deny,status:44,msg:'Multipart request body failed strict validation: PE %{REQBODY_PROCESSOR_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_SEMICOLON_MISSING}, IQ %{MULTIPART_INVALID_QUOTING}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, IH %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Transformation completed in 0 usec.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Executing operator "!eq" with param "0" against MULTIPART_STRICT_ERROR.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] Target value: "0"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Operator completed in 1 usec.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Rule returned 0.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] No match, not chained -> mode NEXT_RULE.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Recipe: Invoking rule 2587bb8; [file "/opt/apache2/conf/modsec.2.6/modsecurity.conf"] [line "79"].
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][5] Rule 2587bb8: SecRule "MULTIPART_UNMATCHED_BOUNDARY" "!@eq 0" "phase:2,auditlog,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Transformation completed in 1 usec.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Executing operator "!eq" with param "0" against MULTIPART_UNMATCHED_BOUNDARY.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] Target value: "0"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Operator completed in 1 usec.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Rule returned 0.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] No match, not chained -> mode NEXT_RULE.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Recipe: Invoking rule 25887f0; [file "/opt/apache2/conf/modsec.2.6/modsecurity.conf"] [line "93"].
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][5] Rule 25887f0: SecRule "TX:/^MSC_/" "!@streq 0" "phase:2,log,auditlog,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][4] Rule returned 0.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/][9] No match, not chained -> mode NEXT_RULE.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Hook insert_filter: Adding output filter (r 7f3434004f10).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][9] Output filter: Receiving output (f 7f34340183a0, r 7f3434004f10).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Starting phase RESPONSE_HEADERS.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][9] This phase consists of 0 rule(s).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][9] Content Injection: Not enabled.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][9] Output filter: Bucket type MMAP contains 79 bytes.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][9] Output filter: Bucket type EOS contains 0 bytes.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Output filter: Completed receiving response body (buffered full - 79 bytes).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Starting phase RESPONSE_BODY.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][9] This phase consists of 0 rule(s).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Output filter: Output forwarding complete.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Initialising logging.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Starting phase LOGGING.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][9] This phase consists of 0 rule(s).
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Recording persistent data took 0 microseconds.
[03/Jun/2011:22:44:46 +0900] [localhost/sid#24e9438][rid#7f3434004f10][/index.html][4] Audit log: Ignoring a non-relevant request.