rotatelogs.exe Not Working in IIS 10 with v2.9.3

[ossie-git]

Describe the bug

I tried configuring and using rotatelogs.exe with v2.9.3 on IIS 10. According to this issue - #685, it should have worked

I'm using rotatelogs.exe from here: https://www.apachehaus.com/cgi-bin/download.plx and the relavent part in my config file is shown below

Logs and dumps

ModSecurity throws the following error in the Event Log where line 199 points to the SecAuditLog line shown below:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='ModSecurity'/>
        <EventID Qualifiers='0'>1</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime='2019-04-20T07:22:07.968155800Z'/>
        <EventRecordID>11784</EventRecordID>
        <Channel>Application</Channel>
        <Computer>WIN10CLIENT1.example.com</Computer>
        <Security/>
    </System>
    <EventData>
        <Data>Syntax error in config file C:\Program Files\ModSecurity IIS\modsecurity.conf, line 199: ModSecurity: Failed to open the audit log pipe: c:\rotatelogs.exe c:\inetpub\logs\modsec_audit.log 120</Data>
    </EventData>
</Event>

To Reproduce

The relevant part from my config is as follows:

SecAuditLogFormat JSON

# Log everything we know about a transaction.
SecAuditLogParts ABIJDEFHZ

# Use a single file for logging. This is much easier to look at, but
# assumes that you will use the audit log only ocassionally.
#
SecAuditLogType Serial
SecAuditLog "|c:\rotatelogs.exe c:\inetpub\logs\modsec_audit.log 120"

Expected behavior

It should rotate the audit log

Server (please complete the following information):

• ModSecurity version (and connector): [ModSecurity v2.9.3]
• WebServer: [IIS 10]
• OS (and distro): [Windows 10]

Rule Set (please complete the following information):
CRS (v3.0.2)

[victorhora]

@ossie-git There's a chance that your issue is related with permissions. Some newest versions of Windows are quite unsigned binaries writing data to some folders.

You can try testing by setting RWX permissions to Everyone and see if the issue persists. If it does, please also provide ModSecurity debug logs that shows the error message related with your issue.

Thanks.

[ossie-git]

Hi @victorhora. I set Everyone permission RX to rotatelogs.exe and Everyone permission to RWX to the directory c:\inetpub\logs and still get the same error. I enabled the Debug Log to Log Level 9 but it doesn't write anything to the debug log. I know debug logging works fine because when my configuration doesn't have rotatelogs, it writes to the debug log

[ossie-git]

Here is the output of related commands:

type "c:\Program Files\ModSecurity IIS\modsecurity.conf" | findstr /i SecAudit

SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogFormat JSON
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog "|c:\rotatelogs.exe c:\inetpub\logs\modsec_audit.log 120"
# SecAuditLog "c:\inetpub\logs\modsec_audit.log"
#SecAuditLogStorageDir c:\inetpub\logs\

icacls c:\rotatelogs.exe

c:\rotatelogs.exe Everyone:(RX)
                  IIS APPPOOL\Site3:(RX)
                  IIS APPPOOL\DefaultAppPool:(RX)
                  BUILTIN\Administrators:(I)(F)
                  NT AUTHORITY\SYSTEM:(I)(F)
                  BUILTIN\Users:(I)(RX)
                  NT AUTHORITY\Authenticated Users:(I)(M)
                  Mandatory Label\High Mandatory Level:(I)(NW)

Successfully processed 1 files; Failed processing 0 files

icacls c:\inetpub\logs\

c:\inetpub\logs\ CREATOR OWNER:(OI)(CI)(IO)(F)
                 NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                 EXAMPLE\johndoe:(OI)(CI)(F)
                 EXAMPLE\Administrator:(OI)(CI)(F)
                 BUILTIN\Administrators:(OI)(CI)(F)
                 Everyone:(OI)(CI)(M)
                 NT SERVICE\TrustedInstaller:(OI)(CI)(F)
                 IIS APPPOOL\Site3:(M)
                 IIS APPPOOL\CSharpGuitarBugs:(M)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\System32\inetsrv\appcmd.exe stop apppool /apppool.name:Site3

"Site3" successfully stopped

C:\Windows\System32\inetsrv\appcmd.exe start apppool /apppool.name:Site3

"Site3" successfully started.

curl http://192.168.123.188:82/ping.aspx

<HTML>
<HEAD>
<title>ASP.NET Ping Application</title>
</HEAD>
<body>
<form method="post" action="./ping.aspx" id="cmd">
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUJMTkxODY5Nzc4ZGSKwdy4+082Unxi8t90ubHHras714mvewpEfeXFE0lhzw==" />

<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="15DEFBD3" />
<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="/wEdAANCRph7o5Cd4dKpHFKw1Jbn2P6Xxdk5ke+WkclAxSHkFXk2JDuMxrvKtMBUSvskgfGGtdviR39rA+CWE4EqO0kdToieEHeJIYek4UUEHGRMXA==" />
<span id="lblText">Command:</span>
<input name="addr" type="text" id="addr" />
<input type="submit" name="testing" value="excute" id="testing" />
</form>
</body>
</HTML>

wevtutil qe Application /rd:true /c:1

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
        <Provider Name="ModSecurity" />
        <EventID Qualifiers="0">1</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2019-04-24T02:41:07.993150100Z" />
        <EventRecordID>12266</EventRecordID>
        <Channel>Application</Channel>
        <Computer>WIN10CLIENT1.example.com</Computer>
        <Security />
    </System>
    <EventData>
        <Data>Syntax error in config file C:\Program Files\ModSecurity IIS\modsecurity.conf, line 199: ModSecurity: Failed to open the audit log pipe: c:\rotatelogs.exe c:\inetpub\logs\modsec_audit.log 120</Data>
    </EventData>
</Event>

[SigmazGFX]

SO WHERE THE HECK IS THE WORKAROUND?!

[SigmazGFX]

I just can't find the support I need to get this working properly with rotatelogs.exe.
One avenue I tried going down was to do it with PowerShell, but becsuse the log file is locked Clear-Contents can't do the job. and I refuse to (can't) restart IIS every time a modsec log gets too big.
I ended up using a little C# to get the job done. I now rotate our modsec logs with a scheduled task.
LogPurge.zip

Hopefully someone can use this.. I'm not a coder by trade but it gets the job done.
Source included.

logpurge.exe (path to logfile)