Atomicorp

Hi I had a similar trigger last week which I submitted a false positive for but its happened again and Google are penalising our sites as they cant crawl and seo is very much a part of what we do.

This hostname got blanked = crawl-66-249-67-201.googlebot.com

The false positive ID is

Time: July 31, 2011 08:04:45
Rule: 60128 - (null)

Is it possible to allow Google bot to do its thing with bar ?

Cheers

The false positive ID is

Time: July 31, 2011 08:04:45
Rule: 60128 - (null)

Thank you the report, we are sorry to hear that you have run into a false positive but do appreciate you reporting it to us. We will get this resolved for you quickly.

To help us to determine the cause of this problem, we need a little more information. Although you have provided use with the time and rule ID for this event, this does not provide us with any of the information we need to help you with this problem. We require the modsecurity audit records for each event to see why this occurred.

We have written up a procedure to help you provide this information to us, and you can find it it here:

https://www.atomicorp.com/wiki/index.ph ... _Positives

If you could kindly follow that procedure and send us the information described there, we can get a fix for your issue out to you quickly.

Thank you in advance.

Hello Mike,

I submitted the false positive and i can see it in the support case portal.

Its numbered 9471 and I submitted the false positive through ASL earlier on today.

I will pm you the output I can see.

Thanks

mikeshinn wrote:

The false positive ID is

Time: July 31, 2011 08:04:45
Rule: 60128 - (null)

Thank you the report, we are sorry to hear that you have run into a false positive but do appreciate you reporting it to us. We will get this resolved for you quickly.

To help us to determine the cause of this problem, we need a little more information. Although you have provided use with the time and rule ID for this event, this does not provide us with any of the information we need to help you with this problem. We require the modsecurity audit records for each event to see why this occurred.

We have written up a procedure to help you provide this information to us, and you can find it it here:

https://www.atomicorp.com/wiki/index.ph ... _Positives

If you could kindly follow that procedure and send us the information described there, we can get a fix for your issue out to you quickly.

Thank you in advance.

I submitted the false positive and i can see it in the support case portal.

Its numbered 9471 and I submitted the false positive through ASL earlier on today.

Thank you, yes I see it. It looks like an apache 403 error, and not a modsecurity event. Thats generally either an actual apache error like permissions, or perhaps something apache is configured to not allow (index directories, etc.). Do you see any details in your apache logs about what apache is not allowing?

Hi I had a good look a this and its seems it was a apache configuration issue as the domain did not have an index file and the indexing of the directory was not allowed hence the error given to Google.

Its definitely not a ASL issue as I just rectified and hopefully when they come back tomorrow it will be all good.

On a side note I actually learned from this how to really control the rules which has helped me understand this all a little bit more.

After going through all the red flags that cropped up and editing the rules I realise the amount of power ASL can give.

Sorry for the false alarm gentlemen and ladies if your in the house ;0)

Good stuff !!