No debug log

[AnoopAlias]

Describe the bug
No, debug log being written even after explicitly setting SecDebugLog and SecDebugLogLevel 9
A clear and concise description of what the bug is.

nginx version: nginx/1.17.8
ibmodsecurity.so.3.0.4

SecDebugLog /var/log/nginx/debug.log
SecDebugLogLevel 9

The file /var/log/nginx/debug.log is blank

Logs and dumps

no logs

Server (please complete the following information):
nginx version: nginx/1.17.8
ibmodsecurity.so.3.0.4
OS: Centos7

Rule Set (please complete the following information):

SecRemoteRules XXXXXX https://rules.malware.expert/download.php?rules=generic

[AnoopAlias]

Possibly a duplicate of owasp-modsecurity/ModSecurity-nginx#17

But I see the issue is closed

[zimmerle]

Hi @AnoopAlias,

Did you observe any crash on your system previous to the logs not being generated?

[AnoopAlias]

No, the server works just fine and I can see mod_sec normal logging in the Nginx error_log, but the explicit SecDebugLog and SecDebugLogLevel directives are simply ignored it seems

[zimmerle]

@AnoopAlias I have seen two cases where that situation occurs:

• The debug logs make usage of shared memory to control the writing flow among the different processes. A brute shutdown may lead to a circumstance where garbage was left on the shared memory that further will imped the debug logs to be written well. List the shared memory attached to Nginx, and try to delete it after stop Nginx / before start it again.

• Wrong permissions from either file system or kernel (SELinux/AppArmor) sometimes the application profile got updated, removing the original permission to write the logs.

Please check if any of those are happening so we can guide better the debug process.

[AnoopAlias]

I can confirm this is not SELinux/AppArmor as it is a cPanel server and SELinux is not in the enabled state

https://i.imgur.com/tAWyAii.png

The permissions also look fine, in fact I tried 777 for the debug.log file and this didn't help too

I am little lost on listing and deleting shared memory attached to the process, but I have tried several times to restart the process after normal shutdown and this doesn't help

[zimmerle]

Restart the process, indeed will not help. Is this server suitable for a restart?

[zimmerle]

@AnoopAlias restarting the server made it workable again?