Error controller?

[Kevin Kien]

Hi waf-fle.

I have install waf-fle when run 192.168.1.161/controller/, it is not show. I am not understand problems. I have use OWASP rule and run rule:

SecRule REQUEST_FILENAME '^/controller/$' \
    "phase:1,msg:'Match',id:99999,nolog,noauditlog,allow,ctl:RuleEngine=On"



Please help me!!

[Klaubert Herr da Silveira]

Hi Kevin, 

The WAF-FLE has two parts:

1) Controller: used by log feeders, like modsec2waffle and mlogc, to receive the events.

2) Dashboard: used to inspect the events.

The controller is not to be used by a browser, it will respond an empty page, like you receive.

To check events use the http://192.168.1.161/waf-fle/

You can check this in details in "WAF-FLE 0.6.3 Deployment Guide" http://www.waf-fle.org/documentation/

The rule used by you, like proposed in README, is needed to avoid CRS (when used in controller box) to block event sent to WAF-FLE.

Feel free to make any other question, 

Best regards, 

Klaubert Herr

WAF-FLE Project

--
You received this message because you are subscribed to the Google Groups "waf-fle" group.
To unsubscribe from this group and stop receiving emails from it, send an email to waf-fle+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Kevin Kien]

Hi klaubert,

Thank you!!

I am install waf-fle but it is not runing.

Can you make video tutorial install waf-fle? 

Thank.

[Klaubert Herr da Silveira]

Hi Kevin, 

Could you please elaborate a little bit more, about what is "not running", this allow me to help you more. Are some error in log?

The problem is about receiving events or about some error in waf-fle?

About a video of waf-fle installation, is planned, but don't have it this time, may be a couple weeks...

Best regards, 

Klaubert

--

[Kevin Kien]

Hi Klaubert,

I have problem when create sensor, it is not show section Info/Stats. 

I read here . it have dislay section Info/Stats. I do not understand that.

Please help me.!!

[Klaubert Herr da Silveira]

Hi, 

The Info/Stat will show data only after receive the first event from the sensor. Your problem is, probably, that sensor is not sending events to WAF-FLE.

Check the sensor side, your modSecurity configuration, the mlog2waffle or mlogc, check the Apache error log (normally /var/log/httpd/error.log) to check if modsecurity events are created, and check if mlog2waffle/mlogc error show you any evidence of problem. 

You can enable debug in mlog2waffle and run it manually to check for any problem on sending the log to WAF-FLE (/etc/mlog2waffle.conf, DEBUG=true).

Could you confirm that modsecurity is generating some event? You can confirm this in Apache error.log, 

Let me know for any more details, 

Best regards, 

Klaubert