ConfigServer Community Forum

Post a log line of your ModSecurity error_log for me to check it, thanks. Sergio This is the exact rule I want it to fire on. Thu Oct 03 13:30:22.623029 2024] [security2:error] [pid 646349:tid 646389] [client ***.***.***.***:60072] [client ***.***.***.***] ModSecurity: Access denied with code 403 (...

Here is the rule that I use to block at the first byte some ModSecurity rules: # BLOCKING ModSec Rules attacks if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\[\S+\s+\S+\s+\S+\s+\S+\.\d+\s+\S+\] \[:error\] \[pid \d+.*\] \[client \S+\] \[client (\S+)\] ModSecurity.*\[id "(210280|210350|2...