From ac123cedc4db80201e8e1dabec747fbed2e82de5 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Sun, 1 Nov 2026 20:52:31 +0100 Subject: [PATCH 1/2] Document where Lua m.log() messages go m.log(level, text) writes to the debug log, and only if SecDebugLogLevel is set to level or higher. ModSecurity v2 also copies levels 1-3 to the Apache error log, but libModSecurity v3 writes them only to the debug log, and not at all in a build configured with --disable-debug-logs. Users coming from v2, or looking in the nginx error log, didn't find their messages. Add a note after the first Lua example of SecRuleScript. Refs owasp-modsecurity/ModSecurity#3035 --- content/3-reference-manual/3-2-configuration-directives.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/3-reference-manual/3-2-configuration-directives.md b/content/3-reference-manual/3-2-configuration-directives.md index 9b0808a..70fd99d 100644 --- a/content/3-reference-manual/3-2-configuration-directives.md +++ b/content/3-reference-manual/3-2-configuration-directives.md @@ -1146,6 +1146,12 @@ function main() end ``` +{{% notice note %}} + +m.log(level, text) writes text to the debug log (see [SecDebugLog](#secdebuglog)), and only if [SecDebugLogLevel](#secdebugloglevel) is set to level or higher. In ModSecurity v2, messages at levels 1–3 are also copied to the Apache error log. libModSecurity v3 writes them only to the debug log, never to the web server's error log or the console, and a library built with --disable-debug-logs doesn't write them at all. + +{{% /notice %}} + In this first example we were only retrieving one variable at the time. In this case the name of the variable is known to you. In many cases, however, you will want to examine variables whose names you won't know in advance, for example script parameters. Example showing use of m.getvars() to retrieve many variables at once: From deb1f69d858038106239c7f50275a5985ad54dd0 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Mon, 2 Nov 2026 22:27:33 +0100 Subject: [PATCH 2/2] Update content/3-reference-manual/3-2-configuration-directives.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Felipe Zipitría <3012076+fzipi@users.noreply.github.com> --- content/3-reference-manual/3-2-configuration-directives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/3-reference-manual/3-2-configuration-directives.md b/content/3-reference-manual/3-2-configuration-directives.md index 70fd99d..b5f9bae 100644 --- a/content/3-reference-manual/3-2-configuration-directives.md +++ b/content/3-reference-manual/3-2-configuration-directives.md @@ -1148,7 +1148,7 @@ end {{% notice note %}} -m.log(level, text) writes text to the debug log (see [SecDebugLog](#secdebuglog)), and only if [SecDebugLogLevel](#secdebugloglevel) is set to level or higher. In ModSecurity v2, messages at levels 1–3 are also copied to the Apache error log. libModSecurity v3 writes them only to the debug log, never to the web server's error log or the console, and a library built with --disable-debug-logs doesn't write them at all. +m.log(level, text) writes text to the debug log (see [SecDebugLog](#secdebuglog)) if [SecDebugLogLevel](#secdebugloglevel) is set to level or higher. In ModSecurity v2, messages at levels 1–3 also always go to the Apache error log and to the audit log, whatever SecDebugLogLevel is set to. libModSecurity v3 writes them only to the debug log, never to the web server's error log or the console, and a library built with --disable-debug-logs doesn't write them at all. {{% /notice %}}