1[
2  {
3    "enabled":1,
4    "version_min":300000,
5    "title":"Testing audit log not written when nolog - issue-2196",
6    "expected":{
7      "http_code":200
8    },
9    "client":{
10      "ip":"127.0.0.1",
11      "port":123
12    },
13    "request":{
14      "headers":{
15        "Host":"localhost",
16        "User-Agent":"curl/7.38.0",
17        "Accept":"*/*"
18      },
19      "uri":"index.php?foo=bar&a=xxx",
20      "method":"GET",
21      "body": ""
22    },
23    "expected": {
24      "http_code": 200,
25      "audit_log": "\\A[\\s\\S]{0}\\z"
26    },
27
28    "server":{
29      "ip":"127.0.0.1",
30      "port":80
31    },
32    "rules":[
33      "SecRuleEngine On",
34      "SecAuditLogParts ABIJDEFHZ",
35      "SecAuditEngine RelevantOnly",
36      "SecAuditLogParts ABCFHZ",
37      "SecAuditLog /tmp/test/modsec_audit.log",
38      "SecAuditLogDirMode 0766",
39      "SecAuditLogFileMode 0666",
40      "SecAuditLogType Serial",
41      "SecAuditLogRelevantStatus \"^(?:5|4(?!04))\"",
42      "SecRule ARGS:foo \"@rx ^bar$\" \"id:1234,phase:1,nolog,pass\""
43    ]
44  }
45]
46