modsecurity blocking requests although being in detection mode (iis 10)

[Montorce]

Hi,

i am using ModSecurity with IIS and after some time ModSecurity seems to block requests although it is in detection mode. Blocking probably isn't the correct description as it isn't blocked because of being marked as evil and then discarded, but ModSecurity just hanging for the first in "SendRequest", all others reqeusts in the status "BeginRequest" without ever completing.
I can see all the requests in the IIS "Requests"-page. I attached a screenshot of such a situation. All entries showed as Modulname "ModSecurity IIS (32bits)".
The only solution i've found so far for get it running again is recycling the application pools.

I am using ModSecurity version 2.9.2-64b on Windows 2016 with IIS 10. Multiple webpages and webservices, all based on .NET 4.0, each with its own application pool. As it is a load balanced environment i am using Scaleout for synchronizing the session state between the webservers.
As base rules i am using owasp-modsecurity-crs-3.2-dev and then modified them a little bit for my needs.
I created different configurations for each application because they need different rules. Each rule set is referenced in the web.config of each application.

I have looked into all log files and Eventlog but haven't seen any error which could relate to this problem. ModSecurity doesn't log anything during such a situation.

Until now i don't really have a clue what this could be. The problems seems to occur without seeing any environment correlation. It happens quite randomly.
My best guess so far would be that ModSecurity allocates some ressources which it doesn't release properly, so after some time it runs into a problematic state and then ceases to work.

How can i resolve/analyze this issue further?

Regards

[victorhora]

Hi @Montorce,

You probably need to set SecStreamInBodyInspection to On. See #1300 (comment)

[Montorce]

Hi @victorhora ,

thank you for your feedback.

Unfortunately I have already enabled this option all the time, so this isn't a solution for me.

Perhaps you have some more ideas to approach my problem.

Regards

[victorhora]

Hi @Montorce,

Thanks for your feedback. If that's the case, it warrants further investigation then. Reopening and tagging it properly.

[victorhora]

Hi,

...ModSecurity just hanging for the first in "SendRequest", all others reqeusts in the status "BeginRequest" without ever completing.

I am using ModSecurity version 2.9.2-64b on Windows 2016 with IIS 10. Multiple webpages and webservices, all based on .NET 4.0, each with its own application pool. As it is a load balanced environment i am using Scaleout for synchronizing the session state between the webservers.
As base rules i am using owasp-modsecurity-crs-3.2-dev and then modified them a little bit for my needs.
I created different configurations for each application because they need different rules. Each rule set is referenced in the web.config of each application.

I have looked into all log files and Eventlog but haven't seen any error which could relate to this problem. ModSecurity doesn't log anything during such a situation.

Until now i don't really have a clue what this could be. The problems seems to occur without seeing any environment correlation. It happens quite randomly.
My best guess so far would be that ModSecurity allocates some ressources which it doesn't release properly, so after some time it runs into a problematic state and then ceases to work.

How can i resolve/analyze this issue further?

Regards

See if you can enable SecDebugLog on your environment and look for error messages on these. You might need to tinker with the log file permissions as Windows 2016 / IIS 10 seems to be more picky with permissions now. (See #812)

Additionally, please be aware that the CRS makes heavy usage of collections for delayed blocking, being so, you might face issues with them for large deployments or busy servers. See if EventViewer shows collection errors or something. You could also try checking if --enable-collection-global-lock build time option helps you if you happen to have issues with collections.

Speaking of CRS, I'm not entirely sure how mature 3.2/dev currently is. Being so, please check if this issue also happens with stable CRS 3.0.

Hope this helps and please let us know if you managed to fix your issue for the benefit of the community :)

[martinhsv]

Closing due to no further information or feedback from poster.