Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: add section for AuditLog sidecar for ModSecurity daemonset #825

Merged
merged 3 commits into from
Jul 29, 2021
Merged

docs: add section for AuditLog sidecar for ModSecurity daemonset #825

merged 3 commits into from
Jul 29, 2021

Conversation

sealneaward
Copy link
Contributor

In our customization of the ModSecurity agent, we have certain rules triggered to write to the auditlog and ignore being printed to the modsecurity-spoa container STDOUT. From my research, there doesn't appear to be a way to configure ModSecurity to also print the audit log file to STDOUT, but that might be better anyways because it would make it harder to read a file being edited with two different log sources.

We need to view what's going into the audit log file through container STDOUT. When we created the daemonset, we added a sidecar container to print that file to STDOUT for further ingestion.

Even though it is simple, it is extremely useful if someone was to seperate the destinations of logs for different rules and actions.

@jcmoraisjr
Copy link
Owner

Lgtm, note however that this is the old examples page (yep I need to clean up things). You can find the sources used to build the doc site in /docs/content/en/docs/examples/. Note also that the modsecurity example has a manifest, you can find it in /docs/static/resources/, add the new one there, and the final path will be https://haproxy-ingress.github.io/resources/filename.yaml

@sealneaward
Copy link
Contributor Author

I updated from review, curious why the static resources aren't tracked. There isn't any line for it in the .gitignore file. @jcmoraisjr any reason for this?

@jcmoraisjr
Copy link
Owner

curious why the static resources aren't tracked

/docs/.gitignore seems to have broken config. Remove the resources/ line just to track the new file, but without adding the .gitignore in the commit. I'll have a look on it.

@sealneaward
Copy link
Contributor Author

Updated with the resources file

@jcmoraisjr
Copy link
Owner

Lgtm, thanks! Merging.

@jcmoraisjr jcmoraisjr merged commit cb6db11 into jcmoraisjr:master Jul 29, 2021
@jcmoraisjr jcmoraisjr changed the title Added section for AuditLog sidecar for ModSecurity daemonset docs: add section for AuditLog sidecar for ModSecurity daemonset Aug 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants