ConfigServer Community Forum

I think it would be extremely useful if csf checked the error code of the audit_log and ban,temp_ban, or ignore based on the error code of the audit_log entry.

eg. permanantly ban any 412 code on 1 connection while temp banning a 403 error code with 5 attempts for X seconds and ignoreing 406 alltogether.

just thought it would add a whole new level of control

exactly what code(s) does csf recognize in the mod_security audit logs? seems some codes will trigger it while others wont.

It uses a regex against the error posted in the apache error_log. You can find the regex in /etc/csf/regex.pm