hooking up ASL to nginx

[imadsani]

Hey,

I finally got modsecurity to work with nginx, I've loaded the rules, copied the apache modsec config file into nginx and it is working as I hoped. I now need to integrate ASL with nginx, as in manage nginx's modsec from within ASL. Even thought Im using the modsec config file from apache it the Security Events window doesn't show offences that I'm throwing at it.

Can this be done?

[scott]

The core things are probably:

SecAuditLogType Concurrent

Only set that to Serial if you hate performance, and you do not want this to work.

SecAuditLog /var/log/httpd/audit_log
SecAuditLogStorageDir /var/asl/data/audit

/var/asl/data/audit will need to be writable by the web server user.