modsecurity安装HTTP全量审计步骤

1)cd /etc/httpd/modsecurity-crs/rules
2)在该目录创建新文件REQUEST-SELF-100-HTTP-audit.conf
vi REQUEST-SELF-100-HTTP-audit.conf
写入
SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess On
SecAuditEngine On
SecAuditLogParts ABCIFEHZ
SecAuditLog /usr/local/apache/logs/audit.log
SecAuditLogType Concurrent
SecAuditLogStorageDir /usr/local/apache/audit/logs/audit


注解：
a)SecAuditLogType Concurrent 代表并行
b)/usr/local/apache/logs/audit.log和/usr/local/apache/audit/logs/audit请确保存在，没有需要自己创建。




3)验证配置
a)进入网站，执行操作。登录，修改内容均可以。
b) cat /usr/local/apache/logs/audit.log
看到如下：
 172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:16 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8eKwbzgcAAD9mEUEAAAAG "-" /20170316/20170316-1046/20170316-104616-WMn8eKwbzgcAAD9mEUEAAAAG 0 2622 md5:1a9c3806299bb34f0e11a06252126348 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/main.php?p=60301&o=c&contact_id=56 HTTP/1.1" 200 115953 "-" "-" WMn8e6wbzgcAAD9iEFwAAAAC "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9iEFwAAAAC 0 127236 md5:44effca7ec920eae8a6b1d24aac66c30 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Modalbox/Color/blue_css.php HTTP/1.1" 200 405 "-" "-" WMn8e6wbzgcAAD9gD-QAAAAA "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9gD-QAAAAA 0 1950 md5:e530e4a72eb117f16e91a3d29119cf19 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Color/blue_css.php HTTP/1.1" 200 4959 "-" "-" WMn8e6wbzgcAAD9lEQgAAAAF "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9lEQgAAAAF 0 1944 md5:1ca3ace6eb8d3aa44303f379ba12d2ba  <