ModSecurity IIS Logging Windows Service
ModSecurity Log Capture Service is a Windows Service that watches the ModSecurity log folder and automatically captures the logs and sends them to a configured NLog target, like a SQL Server Database. It uses a Windows File Watcher, listening to the FileCreated event, at which time it reads the log file, and uses NLog to send the log to the Database. Since it uses NLog, it could be any NLog Target.
ModSecurity is an open source, cross platform web application firewall for IIS, Apache and Nginx.
- How to install the Windows Service
- Configure ModSecurity
- How to configure NLog/Database target settings
- How to uninstall
How to install the Windows Service
- Download the Release zip file
- Unzip the files in the release to a folder.
- Run the
install.ps1
command (Open Powershell as Administrator). (This uses theInstallUtil
from the .NET framework.) - Open up Local Services (Control Panel > Administrative Tools > Services) and select "ModSecurityLog" and click "Start". You may need to update the permissions on the folder to allow the "Network Service" user read access for the service to start.
Configure ModSecurity
-
Open the
modsecurity_iis.conf
file and update it to the following:SecAuditEngine RelevantOnly SecAuditLogType Concurrent SecAuditLogFormat JSON SecAuditLogStorageDir "D:\Path\To\Log\Directory" SecAuditLog "D:\Path\To\Log\Directory\modsec_audit.log"
-
Back in this service's folder, open up the
ModSecurityLogService.exe.config
file and update theLogPath
to be the same as theSecAuditLogStorageDir
value.
Ensure that you restart this windows service (ModSecurityLog) any time you make changes to the ModSecurityLogService.exe.config
file.
How to configure NLog/Database target settings
- Open
nlog.config
, file. - Update the
<target>
to match your Database settings and table format. - Alternatively, create your own custom NLog
<target>
How to uninstall
- Stop the service (Control Panel > Administrative Tools > Services > ModSecurityLog)
- Run the
install.ps1 -uninstall
command. (Open Powershell as Administrator)
To Be Extended..
This service could be extended to trigger IP Restrictions on an external firewall or send an alert to an admin of attack velocity. These are both ideas of modules that could use the ModSecurity data to trigger actions to do something about the alerts.