1[ 2 { 3 "enabled":1, 4 "version_min":300000, 5 "title":"Testing audit log not written when nolog - issue-2196", 6 "expected":{ 7 "http_code":200 8 }, 9 "client":{ 10 "ip":"127.0.0.1", 11 "port":123 12 }, 13 "request":{ 14 "headers":{ 15 "Host":"localhost", 16 "User-Agent":"curl/7.38.0", 17 "Accept":"*/*" 18 }, 19 "uri":"index.php?foo=bar&a=xxx", 20 "method":"GET", 21 "body": "" 22 }, 23 "expected": { 24 "http_code": 200, 25 "audit_log": "\\A[\\s\\S]{0}\\z" 26 }, 27 28 "server":{ 29 "ip":"127.0.0.1", 30 "port":80 31 }, 32 "rules":[ 33 "SecRuleEngine On", 34 "SecAuditLogParts ABIJDEFHZ", 35 "SecAuditEngine RelevantOnly", 36 "SecAuditLogParts ABCFHZ", 37 "SecAuditLog /tmp/test/modsec_audit.log", 38 "SecAuditLogDirMode 0766", 39 "SecAuditLogFileMode 0666", 40 "SecAuditLogType Serial", 41 "SecAuditLogRelevantStatus \"^(?:5|4(?!04))\"", 42 "SecRule ARGS:foo \"@rx ^bar$\" \"id:1234,phase:1,nolog,pass\"" 43 ] 44 } 45] 46