Keep Server Online
If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.
or
A donation makes a contribution towards the costs, the time and effort that's going in this site and building.
Thank You! Steffen
Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
| |
|
 Topic: ModSecurity: StatusEngine call |
|
| Author |
|
EIKA
Joined: 22 Jan 2019
Posts: 43
Location: US
|
 Posted: Mon 20 Jun '22 17:21 Post subject: ModSecurity: StatusEngine call |
 |
|
Hi all!
My Apache 2 has ModSecurity status engine turned ON. But it fails very often since Feb of 2022. Fail looks like this:
| Code: | [Mon Jun 20 07:19:33.796866 2022] [:notice] [pid 6992:tid 384] ModSecurity: StatusEngine call: "2.9.5,Apache/2.4.54 (Win64) Ope,1.7.0/1.7.0,8.45/8.45 2021-06-15,Lua 5.2,2.9.12,3603271f8bf5ff1863a40b7379bed7a16cf651f2"
[Mon Jun 20 07:19:34.812625 2022] [:notice] [pid 6992:tid 384] ModSecurity: StatusEngine call failed. Query: GIXDSLRVFRAXAYLDNBSS6MROGQXDKN.****************.status.modsecurity.org |
Nothing fatal, because this is just a reporting/initial information sent to the ModSecurity's team.
I can easily turn this feature off, but before doing this, I am interested in a reasons of this fail. And how to diagnose it more deeply?
Can it be firewall issue? If YES, what protocol:port should I open to prevent this error? From what I see, it some kind of DNS query. Outbound UDP to port 53 or what? |
|
| Back to top |
|
EIKA
Joined: 22 Jan 2019
Posts: 43
Location: US
|
| Posted: Mon 20 Jun '22 19:51 Post subject: |
|
|
Long story short. This feature is deprecated since the beginning of 2022 and mod_security developers no need your data anymore. For that reason they are closed their data receiver.
Add SecStatusEngine Off to your Apache config and voila!
Official answer:
| Code: | The status engine's purpose is to send limited information about the deployment (e.g. which ModSecurity version are you using) to a central server for statistical purposes.
The failure you are seeing is because the name resolution is not successful. This is expected, since the use case for collecting that information is no longer valued and the receiver no longer exists.
The failure should not cause any functionality problems beyond the message in error.log at startup; you could opt to just ignore it.
However, you may want to turn off the status engine ('SecStatusEngine Off') instead.
I will go ahead and make that change to the modsecurity.conf-recommended files in github. |
|
|
| Back to top |
|
|
|
|
|
|
