SecRule ARGS abc "phase:1,log,deny,status:503"
 

--1a203d52-A--
[06/Apr/2011:16:51:24 +0700] TZw3nH8AAQEAACawDO0AAABA 192.168.25.80 20062 192.168.25.90 80
--1a203d52-B--
GET /?test=abc HTTP/1.1
Host: 192.168.25.90
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
If-None-Match: "4163d-b1-4a03b3c0facd4"
If-Modified-Since: Wed, 06 Apr 2011 07:49:38 GMT

--1a203d52-F--
HTTP/1.1 304 Not Modified
Last-Modified: Wed, 06 Apr 2011 07:49:38 GMT
ETag: "4163d-b1-4a03b3c0facd4"
Accept-Ranges: bytes
Content-Length: 0
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=94
Connection: Keep-Alive
Content-Type: text/html

--1a203d52-E--

--1a203d52-H--
Message: Warning. Pattern match "abc" at ARGS:test. [file "/opt/modsecurity/etc/modsecurity.conf"] [line "28"]
Stopwatch: 1302083484907582 37118 (36600 36603 -)
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.5.13 http://www.modsecurity.org/).
Server: Apache/2.2.16 (Ubuntu)

--1a203d52-K--
SecRule "ARGS" "@rx abc" "phase:1,auditlog,log,deny,status:503"

--1a203d52-Z--