Ingress-nginx: Unable to send modsecurity logs to stdout or different directory

[igpix]

Dear community

I'm trying to send modsecurity logs to stdout without success.
Actually I'm using annotations for ingress resource like below:

nginx.ingress.kubernetes.io/enable-modsecurity: "true"

nginx.ingress.kubernetes.io/enable-owasp-core-rules: "true"

nginx.ingress.kubernetes.io/modsecurity-snippet: |
    SecRuleEngine On
    SecRequestBodyAccess On
    SecAuditEngine RelevantOnly
    SecAuditLogParts ABIJDEFHZ
    SecAuditLogFormat JSON
    SecAuditLogType Serial
    SecAuditLog /dev/stdout

`

Even with serial logging, trasanctions are still written to /var/log/modsec_audit.log and /var/log/audit directories.
Ingress controller installed with helm charts

NGINX Ingress controller
Release: v0.40.2
Build: fc4ccc5eb0e41be2436a978b01477fc354f31643
Repository: https://github.com/kubernetes/ingress-nginx
nginx version: nginx/1.19.3

/triage support

[k8s-ci-robot]

@igpix: The label(s) triage/support cannot be applied, because the repository doesn't have them

In response to this:

Dear community

I'm trying to send modsecurity logs to stdout without success.
Actually I'm using annotations for ingress resource like below:

nginx.ingress.kubernetes.io/enable-modsecurity: "true" nginx.ingress.kubernetes.io/enable-owasp-core-rules: "true" nginx.ingress.kubernetes.io/modsecurity-snippet: | SecRuleEngine On SecRequestBodyAccess On SecAuditEngine RelevantOnly SecAuditLogParts ABIJDEFHZ SecAuditLogFormat JSON SecAuditLogType Serial SecAuditLog /dev/stdout

Even with serial logging, trasanctions are still written to /var/log/modsec_audit.log and /var/log/audit directories.
Ingress controller installed with helm charts

NGINX Ingress controller
Release: v0.40.2
Build: fc4ccc5eb0e41be2436a978b01477fc354f31643
Repository: https://github.com/kubernetes/ingress-nginx
nginx version: nginx/1.19.3

/triage support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[igpix]

Ok I've figured out the correct setup or at least what is ok for my needs
I've used config map for general configurations and annotations only for process the rules in specific ingress resource.
Since we have ingress configured on k8s cluster with all monitoring already in place, the ideal setup is to send audit log to stdout and json format
To manage concurrent logs, a sidecar container can read those files and print them to stdout; moreover with a cron process we can delete old directories and avoid disk saturation.

Below the configuation of nginx ingress.
Hope this help someone.

Version:
NGINX Ingress controller
Release: v0.40.2
Build: fc4ccc5eb0e41be2436a978b01477fc354f31643
Repository: https://github.com/kubernetes/ingress-nginx
nginx version: nginx/1.19.3

data:
  enable-modsecurity: "true"
  modsecurity-snippet: |
    SecAuditLog /dev/stdout
    SecAuditLogFormat JSON
    SecRuleRemoveById 920350
    Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf
kind: ConfigMap

    annotations:
      nginx.ingress.kubernetes.io/modsecurity-snippet:
        SecRuleEngine On

[nickvth]

This setup is working, but all 127.0.0.1 log entries are not nice.

[igpix]

@nickvth which log are you talking about? example?