What is the difference between an Audit Log and a regular Log (In the context of mod_security)?

Posted by Josh on Server Fault See other posts from Server Fault or by Josh
Published on 2010-04-29T19:57:06Z Indexed on 2010/04/29 20:07 UTC
Read the original article Hit count: 374

Filed under:

mod-security

|

log

|

auditing

I am using mod_security: http://www.modsecurity.org/documentation/modsecurity-apache/2.5.12/modsecurity2-apache-reference.pdf

What is the difference between and audit log (audit trail) and a normal log?

I read on wikipedia that an audit log is a log of user activity, if this is the case what would you need another log for - is it for system based issues?

© Server Fault or respective owner

Related posts about mod-security

ModSecurity compile error on nginx

as seen on Server Fault - Search for 'Server Fault'
I'm trying to install ModSecurity on nginx with the following instructions : wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip unzip master cd ModSecurity-master ./autogen.sh ./configure --enable-standalone-module And i got the following error : Checking plataform... Identified… >>> More
modsecurity apache mod-security.conf missing

as seen on Server Fault - Search for 'Server Fault'
Greetings Serverfaultians. I'm not a server guy as you can see from my noob score of 1 point. But maybe those more versed can help me. I'm using Ubuntu v13.10 32-bit Server and Apache2 v2.4.6 and I'm trying to set up and configure modsecurity and modevasive on an internet-exposed production/test… >>> More
How to detect brute force in mod-security

as seen on Server Fault - Search for 'Server Fault'
I checked the core rules set in the mod-security but it's didn't contain the rules related to Brute-Force Attack!!! Did anyone know how to write the rules or the existing rules for this kind of Attack! Thanks in advanced, >>> More
Necesity of ModSecurity if Apache is behind Nginx

as seen on Server Fault - Search for 'Server Fault'
I have my Apache installed behind Nginx. So every request that comes in is first handeled by Nginx. If there is dynamic content needed the request is send to Apache which listens on port 8080. Pretty basic reverse proxy setup. Now with this setup the first entry point is Nginx. Is it still needed… >>> More
Detecting Request that uses invalid Encoding using Modsecurity

as seen on Server Fault - Search for 'Server Fault'
I am trying write a virtual patch using modsecurity for my hosted web application using following rule i.e. <Location /index.php> SecDefaultAction phase:2,t:none,log,deny # Validate parameter names SecRule ARGS_NAMES "!^(articleid)$" \ "msg:'Unknown parameter: %{MATCHED_VAR_NAME}'" # Expecting… >>> More

Related posts about log

Logrotate not doing any rotation

as seen on Super User - Search for 'Super User'
I just set up LogRotate on my RHEL6 server so that it rotates my custom Apache log files. However, it doesn't do anything when i try manually running it. I expect it to rotate the log files "access.log" and "err.log". They have been there for a few days and need to be rotated. Here is the output: [root@pc1… >>> More
ORA-03113 in code. In addition, TNS-12535 and ORA-03137 in alert file

as seen on Stack Overflow - Search for 'Stack Overflow'
I've got an exception that contain ORA-03113: (SiPPSS.GetPrintWorkDirectDetail) - ERR:ORA-03113: end-of-file on communication channel Process ID: 7448 Session ID: 30 Serial number: 9802 ?????:12110937 ????:T855 Oracle.DataAccess.Client.OracleException ORA-03113: end-of-file on communication channel… >>> More
PostgreSQL 8.4 won't start after blackout

as seen on Server Fault - Search for 'Server Fault'
I have problem with starting PostgreSQL 8.4 on Ubuntu 9.10 Server after blackout. When I try to connect to the database it says: psql: server closed the connection unexpectedly This probably means the server terminated abnormally before or while processing the request. When I try to start it by… >>> More
repeated failing passwords in linux security log (/var/log/secure)

as seen on Server Fault - Search for 'Server Fault'
Recently, I opened up the SSH port through my firewalls (and redirecting to my server) so I could check on the (http) server while on the road. The first week or two there was nothing different. But now, three or four weeks later, I see lots of this: Mar 20 08:38:28 localhost sshd[21895]: pam_unix(sshd:auth):… >>> More
How can I back up my ubuntu system?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I'm sure there's a lot of questions on here similar to this, and I've been reading them, but I still feel this warrants a new question. I want nightly, incremental backups (full disk images would waste a lot of space - unless compressed somehow.) Preferably rotating or deleting old backups when running… >>> More