Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[appsec] log_level for appsec-configs loading native modsec rules is ignored #3439

Open
buixor opened this issue Feb 4, 2025 · 1 comment
Labels
kind/bug Something isn't working needs/triage

Comments

@buixor
Copy link
Contributor

buixor commented Feb 4, 2025

What happened?

Having something like:

name: smth/rules
log_level: trace
default_remediation: ban
inband_rules:
 - smth/rules

With smth/rules being:

name: smth/rules
seclang_rules:
 - SecRuleEngine On
 - SecRequestBodyAccess On
seclang_files_rules:
  - some-native-modsec.rules 

the log_level directive seems to be ignored as I don't get info about the loading or processing of native modsec rules.

What did you expect to happen?

do not ignore log_level

How can we reproduce it (as minimally and precisely as possible)?

see sample config above

Anything else we need to know?

No response

Crowdsec version

$ cscli version
# paste output here

OS version

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Enabled collections and parsers

$ cscli hub list -o raw
# paste output here

Acquisition config

```console # On Linux: $ cat /etc/crowdsec/acquis.yaml /etc/crowdsec/acquis.d/* # paste output here

On Windows:

C:> Get-Content C:\ProgramData\CrowdSec\config\acquis.yaml

paste output here

Config show

$ cscli config show
# paste output here

Prometheus metrics

$ cscli metrics
# paste output here

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

@buixor buixor added the kind/bug Something isn't working label Feb 4, 2025
Copy link

github-actions bot commented Feb 4, 2025

@buixor: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

  1. Check Crowdsec Documentation to see if your issue can be self resolved.
  2. You can also join our Discord.
  3. Check Releases to make sure your agent is on the latest version.
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Something isn't working needs/triage
Projects
None yet
Development

No branches or pull requests

1 participant