Litespeed and Comodo Errors

[sahostking]

Hi guys,

I used Comodo WAF with our servers here at Hostking. However we seem to get these whenever we restart Litespeed. Any ideas or anything to be concerned about?

2015-01-09 07:56:04.947 [ERROR] [ModSecurity] unknown server variable while parsing: FILES_TMPNAMES
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: REQBODY_PROCESSOR
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: WEBSERVER_ERROR_LOG
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: FILES
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: FILES_NAMES
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: REQBODY_ERROR
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: MULTIPART_STRICT_ERROR
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: ARGS_COMBINED_SIZE
2015-01-09 07:56:05.003 [ERROR] [ModSecurity] unknown server variable while parsing: FILES_COMBINED_SIZE
2015-01-09 07:56:05.060 [ERROR] [ModSecurity] unknown server variable while parsing: RESOURCE:OSVDB_VULNERABLE
2015-01-09 07:56:05.068 [ERROR] [ModSecurity] failed to parse a modsec variable. while parsing: %{REQUEST_COOKIES.PHPSESSID}
2015-01-09 07:56:05.068 [ERROR] [ModSecurity] failed to parse a modsec variable. while parsing: %{REQUEST_COOKIES.MoodleSession}
2015-01-09 07:56:05.068 [ERROR] [ModSecurity] failed to parse a modsec variable. while parsing: %{REQUEST_COOKIES.MoodleSession}
2015-01-09 07:56:05.068 [ERROR] [ModSecurity] unknown server variable while parsing: FILES_NAMES
2015-01-09 07:56:05.068 [ERROR] [ModSecurity] unknown server variable while parsing: MULTIPART_FILENAME
2015-01-09 07:56:05.068 [ERROR] [ModSecurity] unknown server variable while parsing: FILES_NAMES
2015-01-09 07:56:05.069 [ERROR] [ModSecurity] unknown server variable while parsing: FILES:import_file
2015-01-09 07:56:05.070 [ERROR] [ModSecurity] unknown server variable while parsing: FILES
2015-01-09 07:56:05.071 [ERROR] [ModSecurity] unknown server variable while parsing: ARGS_GET_NAMES
2015-01-09 07:56:05.071 [ERROR] [ModSecurity] unknown server variable while parsing: ARGS_GET_NAMES
2015-01-09 07:56:05.071 [ERROR] [ModSecurity] unknown server variable while parsing: ARGS_GET_NAMES
2015-01-09 07:56:05.071 [ERROR] [ModSecurity] unknown server variable while parsing: Set-Cookie
2015-01-09 07:56:05.104 [ERROR] [ModSecurity] expirevar: unkown collection. while parsing: xmlrpc_brute=900

 

[Michael]

Hello,

These errors mean that the Comodo WAF is using some rules that LSWS does not support. We support the vast majority of ModSecurity rules, but not all of them: https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:mod_security-tips

The errors indicate which rules are being ignored. They will not affect performance.

Cheers,

Michael

 

[Hedloff]

Hello,
These errors mean that the Comodo WAF is using some rules that LSWS does not support. We support the vast majority of ModSecurity rules, but not all of them: http://www.litespeedtech.com/support/wiki/doku.php?id=litespeed_wiki:mod_security_compatibility

Michael

Link is not working?

 

[NiteWave]

the new link is
https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:mod_security-tips

Edit: Link above has been corrected as well.

 

[Hedloff]

Thanks
Do you work with Comodo in anyway?

We have Comodo WAF on all our Litespeed servers and we constantly have issues. Now they are not working and just keeps causing issues.
I would love to see if you could work togheter with them or setup a testing server with Litespeed + Comodo WAF and fix all the issues.

Right now I'm considering moving back to Apache for all Litespeed servers because of the high load. And Apache servers are just more lucrative then Litespeed because mod_sec is not working.