The modsecurity log is output to the nginx error log instead of /var/log/modsec_audit.log

[Hello-Linux]

I set the input log to /var/log/modsec_audit.log in the modsecurity configuration file, why doesn't it take effect?
the config is

[martinhsv]

Hi @Hello-Linux ,

Logging is impacted by several different settings.

First, What code branch are you talking about? (I think you've looked at 3.1-experimental in the context of other issues) Or should I assume that you are using ModSecurity v3.0.4 or the current v3/master.

Also:

• what rule is being logged to the server's error log, but that is not being logged to the audit_log?
• what disruptive actions (e.g. block/deny) are relevant (both in the rule itself and in any default actions)?
• what logging actions do you have set in each (log,noauditlog, etc.)
• are you using error redirects or anything similar? Or just a basic nginx configuration?
• are you never able to see anything in the audit_log or is it only for some transactions?

[zimmerle]

No feedback from the user, closing the issue.